Clamp ds_bgofs in sw water ripples to fix crash

src/r_plane.cpp

@@ -13,6 +13,8 @@
 ///        while maintaining a per column clipping list only.
 ///        Moreover, the sky areas have to be determined.
 
+#include <algorithm>
+
 #include "doomdef.h"
 #include "console.h"
 #include "g_game.h"
@@ -225,6 +227,9 @@ static void R_MapPlane(INT32 y, INT32 x1, INT32 x2)
 	ds_x1 = x1;
 	ds_x2 = x2;
 
+	// ds_bgofs must not cause an out-of-bounds read
+	ds_bgofs = std::clamp(ds_bgofs, -ds_y, vid.height - ds_y - 1);
+
 	spanfunc();
 }