R_DrawMaskedColumn: set texheight to column length

- In R_DrawColumnTemplate, texheight is used to switch
  between a non-PO2 rasterizer and a more efficient PO2
  rasterizer.
- There is bounds checking on the non-PO2 version (in the
  form of sourcelength) but not on the PO2 version.
- texheight was set to the sprite patch height, which may
  be taller than the column (sourcelength), leading to a
  read out of bounds.
This commit is contained in:
James R 2024-02-03 00:58:27 -08:00
parent 93ff380730
commit efd0170856

View file

@ -689,6 +689,7 @@ void R_DrawMaskedColumn(drawcolumndata_t* dc, column_t *column, column_t *bright
{
dc->source = (UINT8 *)column + 3;
dc->sourcelength = column->length;
dc->texheight = column->length;
if (brightmap != NULL)
{
dc->brightmap = (UINT8 *)brightmap + 3;
@ -775,6 +776,7 @@ void R_DrawFlippedMaskedColumn(drawcolumndata_t* dc, column_t *column, column_t
{
dc->source = static_cast<UINT8*>(ZZ_Alloc(column->length));
dc->sourcelength = column->length;
dc->texheight = column->length;
for (s = (UINT8 *)column+2+column->length, d = dc->source; d < dc->source+column->length; --s)
*d++ = *s;