commit 9ea3cb62c94b2f293cc5dbc95518b8312434e093
Author:     Simon Howard <fraggle@gmail.com>
AuthorDate: Thu Nov 5 19:57:55 2009 +0000
Commit:     Simon Howard <fraggle@gmail.com>
CommitDate: Thu Nov 5 19:57:55 2009 +0000

    Perform bounds checking on values passed to TXT_UpdateScreenArea() to
    avoid crashes.

    Subversion-branch: /trunk/chocolate-doom
    Subversion-revision: 1728
---
 textscreen/txt_sdl.c | 31 ++++++++++++++++++++++++++++---
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/textscreen/txt_sdl.c b/textscreen/txt_sdl.c
index 4f8bc2a8..cd7dd77d 100644
--- a/textscreen/txt_sdl.c
+++ b/textscreen/txt_sdl.c
@@ -263,19 +263,44 @@ static inline void UpdateCharacter(int x, int y)
     }
 }

+static int LimitToRange(int val, int min, int max)
+{
+    if (val < min)
+    {
+        return min;
+    }
+    else if (val > max)
+    {
+        return max;
+    }
+    else
+    {
+        return val;
+    }
+}
+
 void TXT_UpdateScreenArea(int x, int y, int w, int h)
 {
     int x1, y1;
+    int x_end;
+    int y_end;
+
+    x_end = LimitToRange(x + w, 0, TXT_SCREEN_W - 1);
+    y_end = LimitToRange(y + h, 0, TXT_SCREEN_H - 1);
+    x = LimitToRange(x, 0, TXT_SCREEN_W - 1);
+    y = LimitToRange(y, 0, TXT_SCREEN_H - 1);

-    for (y1=y; y1<y+h; ++y1)
+    for (y1=y; y1<y_end; ++y1)
     {
-        for (x1=x; x1<x+w; ++x1)
+        for (x1=x; x1<x_end; ++x1)
         {
             UpdateCharacter(x1, y1);
         }
     }

-    SDL_UpdateRect(screen, x * font->w, y * font->h, w * font->w, h * font->h);
+    SDL_UpdateRect(screen,
+                   x * font->w, y * font->h,
+                   (x_end - x) * font->w, (y_end - y) * font->h);
 }

 void TXT_UpdateScreen(void)