From 1b556b45bf9057674600db61096a10c6f19192a3 Mon Sep 17 00:00:00 2001
From: "seer-by-sentry[bot]"
 <157164994+seer-by-sentry[bot]@users.noreply.github.com>
Date: Tue, 11 Nov 2025 19:59:21 +0000
Subject: [PATCH] WorldHeightMap: Add bounds checks for blendNdx to prevent
 crashes

---
 .../Source/W3DDevice/GameClient/WorldHeightMap.cpp        | 8 ++++++++
 .../Source/W3DDevice/GameClient/WorldHeightMap.cpp        | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/Generals/Code/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp b/Generals/Code/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp
index 8a2066b5613..0979fed7c0c 100644
--- a/Generals/Code/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp
+++ b/Generals/Code/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp
@@ -1768,6 +1768,9 @@ Bool WorldHeightMap::getExtraAlphaUVData(Int xIndex, Int yIndex, float U[4], flo
 		Short blendNdx = m_extraBlendTileNdxes[ndx];
 		if (blendNdx == 0) {
 			return FALSE;
+		} else if (blendNdx < 0 || blendNdx >= m_numBlendedTiles) {
+			// Bounds check failed - treat as no blending to prevent crash
+			return FALSE;
 		} else {
 			*cliff = getUVForTileIndex(ndx, m_blendedTiles[blendNdx].blendNdx, U, V, FALSE);
 			alpha[0] = alpha[1] = alpha[2] = alpha[3] = 0;
@@ -1861,6 +1864,11 @@ void WorldHeightMap::getAlphaUVData(Int xIndex, Int yIndex, float U[4], float V[
 			alpha[0] = alpha[1] = alpha[2] = alpha[3] = 0;
 			// No alpha blend, so never need to flip.
 			needFlip = false;
+		} else if (blendNdx < 0 || blendNdx >= m_numBlendedTiles) {
+			// Bounds check failed - treat as no blending to prevent crash
+			stretchedForCliff = getUVForTileIndex(ndx, m_tileNdxes[ndx], U, V, fullTile);
+			alpha[0] = alpha[1] = alpha[2] = alpha[3] = 0;
+			needFlip = false;
 		} else {
 			stretchedForCliff = getUVForTileIndex(ndx, m_blendedTiles[blendNdx].blendNdx, U, V, fullTile);
 			alpha[0] = alpha[1] = alpha[2] = alpha[3] = 0;
diff --git a/GeneralsMD/Code/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp b/GeneralsMD/Code/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp
index c5b6bddffd0..400e9535db0 100644
--- a/GeneralsMD/Code/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp
+++ b/GeneralsMD/Code/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp
@@ -1972,6 +1972,9 @@ Bool WorldHeightMap::getExtraAlphaUVData(Int xIndex, Int yIndex, float U[4], flo
 		Short blendNdx = m_extraBlendTileNdxes[ndx];
 		if (blendNdx == 0) {
 			return FALSE;
+		} else if (blendNdx < 0 || blendNdx >= m_numBlendedTiles) {
+			// Bounds check failed - treat as no blending to prevent crash
+			return FALSE;
 		} else {
 			*cliff = getUVForTileIndex(ndx, m_blendedTiles[blendNdx].blendNdx, U, V, FALSE);
 			alpha[0] = alpha[1] = alpha[2] = alpha[3] = 0;
@@ -2065,6 +2068,11 @@ void WorldHeightMap::getAlphaUVData(Int xIndex, Int yIndex, float U[4], float V[
 			alpha[0] = alpha[1] = alpha[2] = alpha[3] = 0;
 			// No alpha blend, so never need to flip.
 			needFlip = false;
+		} else if (blendNdx < 0 || blendNdx >= m_numBlendedTiles) {
+			// Bounds check failed - treat as no blending to prevent crash
+			stretchedForCliff = getUVForTileIndex(ndx, m_tileNdxes[ndx], U, V, fullTile);
+			alpha[0] = alpha[1] = alpha[2] = alpha[3] = 0;
+			needFlip = false;
 		} else {
 			stretchedForCliff = getUVForTileIndex(ndx, m_blendedTiles[blendNdx].blendNdx, U, V, fullTile);
 			alpha[0] = alpha[1] = alpha[2] = alpha[3] = 0;