From: havoc <havoc@d7cf8633-e32d-0410-b094-e92efae38249>
Date: Tue, 11 Oct 2016 02:56:31 +0000 (+0000)
Subject: Fix bad memory overrun bug in R_Shadow_PrepareLights_AddSceneLight - it was not multi... 
X-Git-Tag: xonotic-v0.8.5~88^2~35
X-Git-Url: http://git.xonotic.org/?p=xonotic%2Fdarkplaces.git;a=commitdiff_plain;h=212a93f6f5c06d50d331d61e1792d12f11ca1595

Fix bad memory overrun bug in R_Shadow_PrepareLights_AddSceneLight - it was not multiplying the array size by sizeof.

Thanks to Monster for reporting this bug.

git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@12287 d7cf8633-e32d-0410-b094-e92efae38249
---

diff --git a/r_shadow.c b/r_shadow.c
index 202ca281..91b704c1 100644
--- a/r_shadow.c
+++ b/r_shadow.c
@@ -5068,8 +5068,8 @@ qboolean R_Shadow_PrepareLights_AddSceneLight(rtlight_t *rtlight)
 		return false;
 	if (r_shadow_scenemaxlights <= r_shadow_scenenumlights && r_shadow_scenemaxlights < MAX_SCENELIGHTS)
 	{
-		r_shadow_scenemaxlights = bound(1024, r_shadow_scenemaxlights, 65536);
-		r_shadow_scenelightlist = (rtlight_t **)Mem_Realloc(r_main_mempool, r_shadow_scenelightlist, r_shadow_scenemaxlights);
+		r_shadow_scenemaxlights = bound(1024, r_shadow_scenemaxlights, MAX_SCENELIGHTS);
+		r_shadow_scenelightlist = (rtlight_t **)Mem_Realloc(r_main_mempool, r_shadow_scenelightlist, r_shadow_scenemaxlights * sizeof(rtlight_t *));
 	}
 	r_shadow_scenelightlist[r_shadow_scenenumlights++] = rtlight;
 	return true;