skinref_t: Don't dereference out-of-range

- Misjudged the boundary conditions as `numskins == MAXSKINS` is valid
- Internal version of public MR !113, credit Alu Folie for bringing attention to the area of error
This commit is contained in:
toaster 2025-05-26 21:25:06 +01:00
parent e1cab3a62e
commit b4bb4db12b
2 changed files with 2 additions and 2 deletions

View file

@ -214,7 +214,7 @@ void srb2::save_ng_gamedata()
{
newrecords.bestskin = String(skinref.unloaded->name);
}
else
else if (skinref.id < numskins)
{
newrecords.bestskin = String(skins[skinref.id].name);
}

View file

@ -3029,7 +3029,7 @@ fixed_t M_DrawCupWinData(INT32 rankx, INT32 ranky, cupheader_t *cup, UINT8 diffi
patch_t *charPat = NULL;
if ((windata->best_skin.unloaded != NULL)
|| (windata->best_skin.id > numskins))
|| (windata->best_skin.id >= numskins))
{
colormap = NULL;