commit 005a79c6528d7b98c37f24e548e805f6435f0e36
Author:     Simon Howard <fraggle@soulsphere.org>
AuthorDate: Fri Jan 5 01:24:29 2018 +0100
Commit:     Simon Howard <fraggle@soulsphere.org>
CommitDate: Fri Jan 5 01:24:29 2018 +0100

    hexen: Add bounds checking for map variables.

    There is a fixed number of map variables and the limit should not
    be exceeded.
---
 src/hexen/p_acs.c | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/src/hexen/p_acs.c b/src/hexen/p_acs.c
index 2197e984..8a491a7b 100644
--- a/src/hexen/p_acs.c
+++ b/src/hexen/p_acs.c
@@ -891,6 +891,15 @@ static int ReadScriptVar(void)
     return var;
 }

+static int ReadMapVar(void)
+{
+    int var = ReadCodeImmediate();
+    ACSAssert(var >= 0, "negative map variable: %d < 0", var);
+    ACSAssert(var < MAX_ACS_MAP_VARS,
+              "invalid map variable: %d >= %d", var, MAX_ACS_MAP_VARS);
+    return var;
+}
+
 //==========================================================================
 //
 // P-Code Commands
@@ -1170,8 +1179,7 @@ static int CmdAssignScriptVar(void)

 static int CmdAssignMapVar(void)
 {
-    MapVars[LONG(*PCodePtr)] = Pop();
-    ++PCodePtr;
+    MapVars[ReadMapVar()] = Pop();
     return SCRIPT_CONTINUE;
 }

@@ -1190,8 +1198,7 @@ static int CmdPushScriptVar(void)

 static int CmdPushMapVar(void)
 {
-    Push(MapVars[LONG(*PCodePtr)]);
-    ++PCodePtr;
+    Push(MapVars[ReadMapVar()]);
     return SCRIPT_CONTINUE;
 }

@@ -1210,8 +1217,7 @@ static int CmdAddScriptVar(void)

 static int CmdAddMapVar(void)
 {
-    MapVars[LONG(*PCodePtr)] += Pop();
-    ++PCodePtr;
+    MapVars[ReadMapVar()] += Pop();
     return SCRIPT_CONTINUE;
 }

@@ -1230,8 +1236,7 @@ static int CmdSubScriptVar(void)

 static int CmdSubMapVar(void)
 {
-    MapVars[LONG(*PCodePtr)] -= Pop();
-    ++PCodePtr;
+    MapVars[ReadMapVar()] -= Pop();
     return SCRIPT_CONTINUE;
 }

@@ -1250,8 +1255,7 @@ static int CmdMulScriptVar(void)

 static int CmdMulMapVar(void)
 {
-    MapVars[LONG(*PCodePtr)] *= Pop();
-    ++PCodePtr;
+    MapVars[ReadMapVar()] *= Pop();
     return SCRIPT_CONTINUE;
 }

@@ -1270,8 +1274,7 @@ static int CmdDivScriptVar(void)

 static int CmdDivMapVar(void)
 {
-    MapVars[LONG(*PCodePtr)] /= Pop();
-    ++PCodePtr;
+    MapVars[ReadMapVar()] /= Pop();
     return SCRIPT_CONTINUE;
 }

@@ -1290,8 +1293,7 @@ static int CmdModScriptVar(void)

 static int CmdModMapVar(void)
 {
-    MapVars[LONG(*PCodePtr)] %= Pop();
-    ++PCodePtr;
+    MapVars[ReadMapVar()] %= Pop();
     return SCRIPT_CONTINUE;
 }

@@ -1310,8 +1312,7 @@ static int CmdIncScriptVar(void)

 static int CmdIncMapVar(void)
 {
-    ++MapVars[LONG(*PCodePtr)];
-    ++PCodePtr;
+    ++MapVars[ReadMapVar()];
     return SCRIPT_CONTINUE;
 }

@@ -1330,8 +1331,7 @@ static int CmdDecScriptVar(void)

 static int CmdDecMapVar(void)
 {
-    --MapVars[LONG(*PCodePtr)];
-    ++PCodePtr;
+    --MapVars[ReadMapVar()];
     return SCRIPT_CONTINUE;
 }