commit cc92d31eeaa40ae966196cfa5402474ffda0bbc7
Author:     Simon Howard <fraggle@gmail.com>
AuthorDate: Sat Oct 10 01:02:58 2009 +0000
Commit:     Simon Howard <fraggle@gmail.com>
CommitDate: Sat Oct 10 01:02:58 2009 +0000

    Don't crash when using the donut special type and the joining linedef is
    one sided (thanks Alexander Waldmann).

    Subversion-branch: /trunk/chocolate-doom
    Subversion-revision: 1711
---
 src/p_spec.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/p_spec.c b/src/p_spec.c
index 27042b5d..5bb6f19d 100644
--- a/src/p_spec.c
+++ b/src/p_spec.c
@@ -1199,6 +1199,24 @@ int EV_DoDonut(line_t*	line)

 	rtn = 1;
 	s2 = getNextSector(s1->lines[0],s1);
+
+        // Vanilla Doom does not check if the linedef is one sided.  The
+        // game does not crash, but reads invalid memory and causes the
+        // sector floor to move "down" to some unknown height.
+        // DOSbox prints a warning about an invalid memory access.
+        //
+        // I'm not sure exactly what invalid memory is being read.  This
+        // isn't something that should be done, anyway.
+        // Just print a warning and return.
+
+        if (s2 == NULL)
+        {
+            fprintf(stderr,
+                    "EV_DoDonut: linedef had no second sidedef! "
+                    "Unexpected behavior may occur in Vanilla Doom. \n");
+	    break;
+        }
+
 	for (i = 0;i < s2->linecount;i++)
 	{
 	    if ((!s2->lines[i]->flags & ML_TWOSIDED) ||