From ff43b7e913a74882caa065aa6878d734f916f002 Mon Sep 17 00:00:00 2001
From: Randy Heit <rheit@zdoom.fake>
Date: Sun, 1 Jun 2008 04:09:49 +0000
Subject: [PATCH] - Added coordinate range checking to
 DCanvas::ParseDrawTextureTags() to avoid   potential crashes in the situation
 that con_scaletext is 2 and somebody   uses a hud message as if a hud size
 was specified, but forgot to actually   set the hud size.

SVN r1010 (trunk)
---
 docs/rh-log.txt | 4 ++++
 src/v_draw.cpp  | 6 ++++++
 2 files changed, 10 insertions(+)

diff --git a/docs/rh-log.txt b/docs/rh-log.txt
index d976c2915..3c2183a25 100644
--- a/docs/rh-log.txt
+++ b/docs/rh-log.txt
@@ -1,4 +1,8 @@
 May 31, 2008
+- Added coordinate range checking to DCanvas::ParseDrawTextureTags() to avoid
+  potential crashes in the situation that con_scaletext is 2 and somebody
+  uses a hud message as if a hud size was specified, but forgot to actually
+  set the hud size.
 - Consolidated the mug shot code shared by DSBarInfo and DDoomStatusBar
   into a single place.
 - Fixed: Setting an invalid mug shot state crashed the game.
diff --git a/src/v_draw.cpp b/src/v_draw.cpp
index b07115479..0638bb38f 100644
--- a/src/v_draw.cpp
+++ b/src/v_draw.cpp
@@ -298,6 +298,12 @@ bool DCanvas::ParseDrawTextureTags (FTexture *img, int x, int y, DWORD tag, va_l
 		return false;
 	}
 
+	// Do some sanity checks on the coordinates.
+	if (x < -16383 || x > 16383 || y < -16383 || y > 16383)
+	{
+		return false;
+	}
+
 	virtBottom = false;
 
 	parms->texwidth = img->GetScaledWidth();