From 8da7bc729897deb472da176263927335f9cf82e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gustaf=20Alh=C3=A4ll?= Date: Sun, 21 Dec 2025 15:11:53 +0100 Subject: [PATCH] Fix integer overflow recursing through BSP for weather checks --- src/p_mobj.c | 4 ++-- src/s_sound.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/p_mobj.c b/src/p_mobj.c index 3f0b3a765..1301fbfec 100644 --- a/src/p_mobj.c +++ b/src/p_mobj.c @@ -12215,8 +12215,8 @@ void P_PrecipitationEffects(void) closedist = SEARCHRADIUS*2; #undef SEARCHRADIUS - for (y = yl; y <= yh; y += RADIUSSTEP) - for (x = xl; x <= xh; x += RADIUSSTEP) + for (y = yl; y >= yl && y <= yh; y += RADIUSSTEP) + for (x = xl; x >= xl && x <= xh; x += RADIUSSTEP) { if (R_PointInSubsectorFast((fixed_t)x, (fixed_t)y)->sector->ceilingpic != skyflatnum) // Found the outdoors! continue; diff --git a/src/s_sound.c b/src/s_sound.c index b1344cc07..c89d53c41 100644 --- a/src/s_sound.c +++ b/src/s_sound.c @@ -1097,8 +1097,8 @@ boolean S_AdjustSoundParams(const mobj_t *listener, const mobj_t *source, INT32 xl = listensource.x - 1024*FRACUNIT; xh = listensource.x + 1024*FRACUNIT; approx_dist = 1024*FRACUNIT; - for (y = yl; y <= yh; y += FRACUNIT*64) - for (x = xl; x <= xh; x += FRACUNIT*64) + for (y = yl; y >= yl && y <= yh; y += FRACUNIT*64) + for (x = xl; x >= xl && x <= xh; x += FRACUNIT*64) { if (R_PointInSubsectorFast(x, y)->sector->ceilingpic == skyflatnum) {