From 212a93f6f5c06d50d331d61e1792d12f11ca1595 Mon Sep 17 00:00:00 2001 From: havoc Date: Tue, 11 Oct 2016 02:56:31 +0000 Subject: [PATCH] Fix bad memory overrun bug in R_Shadow_PrepareLights_AddSceneLight - it was not multiplying the array size by sizeof. Thanks to Monster for reporting this bug. git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@12287 d7cf8633-e32d-0410-b094-e92efae38249 --- r_shadow.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/r_shadow.c b/r_shadow.c index 202ca281..91b704c1 100644 --- a/r_shadow.c +++ b/r_shadow.c @@ -5068,8 +5068,8 @@ qboolean R_Shadow_PrepareLights_AddSceneLight(rtlight_t *rtlight) return false; if (r_shadow_scenemaxlights <= r_shadow_scenenumlights && r_shadow_scenemaxlights < MAX_SCENELIGHTS) { - r_shadow_scenemaxlights = bound(1024, r_shadow_scenemaxlights, 65536); - r_shadow_scenelightlist = (rtlight_t **)Mem_Realloc(r_main_mempool, r_shadow_scenelightlist, r_shadow_scenemaxlights); + r_shadow_scenemaxlights = bound(1024, r_shadow_scenemaxlights, MAX_SCENELIGHTS); + r_shadow_scenelightlist = (rtlight_t **)Mem_Realloc(r_main_mempool, r_shadow_scenelightlist, r_shadow_scenemaxlights * sizeof(rtlight_t *)); } r_shadow_scenelightlist[r_shadow_scenenumlights++] = rtlight; return true; -- 2.39.2