commit a89a0e655d6a10d2d3951fb2f129d8ccdd2a4945
Author:     Simon Howard <fraggle@soulsphere.org>
AuthorDate: Sat Sep 2 19:33:22 2017 -0400
Commit:     Simon Howard <fraggle@soulsphere.org>
CommitDate: Sat Sep 2 19:33:22 2017 -0400

    Add checks in P_RespawnSpecials().

    When respawning a mobj we scan the mobjinfo[] array to find the type
    that represents the object. It's possible that we don't find it and in
    this case an array index overrun occurs. Handle this by exiting with an
    error rather than continuing. This was detected by cppcheck static
    analyses set up by @turol and blocking #939.
---
 src/doom/p_mobj.c   | 9 ++++++++-
 src/strife/p_mobj.c | 7 +++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/doom/p_mobj.c b/src/doom/p_mobj.c
index 3091de17..dd5a93db 100644
--- a/src/doom/p_mobj.c
+++ b/src/doom/p_mobj.c
@@ -653,7 +653,14 @@ void P_RespawnSpecials (void)
 	if (mthing->type == mobjinfo[i].doomednum)
 	    break;
     }
-
+
+    if (i >= NUMMOBJTYPES)
+    {
+        I_Error("P_RespawnSpecials: Failed to find mobj type with doomednum "
+                "%d when respawning thing. This would cause a buffer overrun "
+                "in vanilla Doom", mthing->type);
+    }
+
     // spawn it
     if (mobjinfo[i].flags & MF_SPAWNCEILING)
 	z = ONCEILINGZ;
diff --git a/src/strife/p_mobj.c b/src/strife/p_mobj.c
index bf5a3ba0..919c4a7b 100644
--- a/src/strife/p_mobj.c
+++ b/src/strife/p_mobj.c
@@ -782,6 +782,13 @@ void P_RespawnSpecials (void)
             break;
     }

+    if (i >= NUMMOBJTYPES)
+    {
+        I_Error("P_RespawnSpecials: Failed to find mobj type with doomednum "
+                "%d when respawning thing. This would cause a buffer overrun "
+                "in vanilla Strife.", mthing->type);
+    }
+
     // spawn it
     if (mobjinfo[i].flags & MF_SPAWNCEILING)
         z = ONCEILINGZ;