commit 29994d4dbd93a67cf8e39d72230c963e14974b42
Author:     Simon Howard <fraggle@soulsphere.org>
AuthorDate: Fri Jan 5 20:28:53 2018 +0100
Commit:     Simon Howard <fraggle@soulsphere.org>
CommitDate: Fri Jan 5 20:28:53 2018 +0100

    hexen: Validate ACS instructions.

    We do an array lookup based on the instruction we read, so it is
    important that the instruction is within the bounds of the array. In
    particular the instruction may an extension supported by an advanced
    source port like ZDoom, that we don't support.
---
 src/hexen/p_acs.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/hexen/p_acs.c b/src/hexen/p_acs.c
index e6bc5e99..163aaaa6 100644
--- a/src/hexen/p_acs.c
+++ b/src/hexen/p_acs.c
@@ -717,6 +717,11 @@ void T_InterpretACS(acs_t * script)
     do
     {
         cmd = ReadCodeInt();
+        ACSAssert(cmd >= 0, "negative ACS instruction %d", cmd);
+        ACSAssert(cmd < arrlen(PCodeCmds),
+                  "invalid ACS instruction %d (maybe this WAD is designed "
+                  "for an advanced source port and is not vanilla "
+                  "compatible)", cmd);
         action = PCodeCmds[cmd]();
     } while (action == SCRIPT_CONTINUE);