From 522c79927ccf9f503a5472a078876d4d77d4093e Mon Sep 17 00:00:00 2001
From: "seer-by-sentry[bot]"
 <157164994+seer-by-sentry[bot]@users.noreply.github.com>
Date: Mon, 29 Dec 2025 18:45:30 +0000
Subject: [PATCH] Font Rendering: Implement robust validation for Unicode array
 access and buffer list pointers

---
 .../Source/WWVegas/WW3D2/render2dsentence.cpp | 38 +++++++++++++++++--
 1 file changed, 34 insertions(+), 4 deletions(-)

diff --git a/Core/Libraries/Source/WWVegas/WW3D2/render2dsentence.cpp b/Core/Libraries/Source/WWVegas/WW3D2/render2dsentence.cpp
index 2c358cbd1c5..96c3178be4e 100644
--- a/Core/Libraries/Source/WWVegas/WW3D2/render2dsentence.cpp
+++ b/Core/Libraries/Source/WWVegas/WW3D2/render2dsentence.cpp
@@ -1278,7 +1278,13 @@ FontCharsClass::Get_Char_Data (WCHAR ch)
 	else
 	{
 		Grow_Unicode_Array( ch );
-		retval = UnicodeCharArray[ch - FirstUnicodeChar];
+		
+		//
+		//	Validate that the UnicodeCharArray is properly allocated and the index is valid
+		//
+		if ( UnicodeCharArray != NULL && ch >= FirstUnicodeChar && ch <= LastUnicodeChar ) {
+			retval = UnicodeCharArray[ch - FirstUnicodeChar];
+		}
 	}
 
 	//
@@ -1398,7 +1404,20 @@ FontCharsClass::Store_GDI_Char (WCHAR ch)
 	//	Get a pointer to the surface that this character should use
 	//
 	Update_Current_Buffer( char_size.cx );
-	uint16* curr_buffer_p = BufferList[BufferList.Count () - 1]->Buffer;
+	
+	//
+	//	Validate that we have a valid buffer before proceeding
+	//
+	if ( BufferList.Count () == 0 || BufferList[BufferList.Count () - 1] == NULL ) {
+		return NULL;
+	}
+	
+	//
+	//	Cache the buffer pointer immediately after Update_Current_Buffer()
+	//	to prevent race conditions if BufferList is modified
+	//
+	FontCharsBuffer* current_buffer = BufferList[BufferList.Count () - 1];
+	uint16* curr_buffer_p = current_buffer->Buffer;
 	curr_buffer_p += CurrPixelOffset;
 
 	//
@@ -1472,7 +1491,7 @@ FontCharsClass::Store_GDI_Char (WCHAR ch)
 	FontCharsClassCharDataStruct *char_data	= W3DNEW FontCharsClassCharDataStruct;
 	char_data->Value				= ch;
 	char_data->Width				= char_size.cx;
-	char_data->Buffer				= BufferList[BufferList.Count () - 1]->Buffer + CurrPixelOffset;
+	char_data->Buffer				= current_buffer->Buffer + CurrPixelOffset;
 
 	//
 	//	Insert this character into our array
@@ -1480,7 +1499,18 @@ FontCharsClass::Store_GDI_Char (WCHAR ch)
 	if ( ch < 256 ) {
 		ASCIICharArray[ch] = char_data;
 	} else {
-		UnicodeCharArray[ch - FirstUnicodeChar] = char_data;
+		//
+		//	Ensure the Unicode array is allocated and the index is valid
+		//
+		if ( UnicodeCharArray != NULL && ch >= FirstUnicodeChar && ch <= LastUnicodeChar ) {
+			UnicodeCharArray[ch - FirstUnicodeChar] = char_data;
+		} else {
+			//
+			//	Failed to allocate Unicode array - clean up and return NULL
+			//
+			delete char_data;
+			return NULL;
+		}
 	}
 
 	//