From 2c3c3cceb9c88205dd644358074333a1b3c30328 Mon Sep 17 00:00:00 2001
From: "seer-by-sentry[bot]"
 <157164994+seer-by-sentry[bot]@users.noreply.github.com>
Date: Sun, 5 Oct 2025 02:56:54 +0000
Subject: [PATCH] W3DTreeBuffer: Move startVertex declaration to avoid
 potential out-of-bounds write

---
 .../Source/W3DDevice/GameClient/W3DTreeBuffer.cpp              | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Generals/Code/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp b/Generals/Code/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
index 329d11e8800..dd3c27dfa2d 100644
--- a/Generals/Code/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
+++ b/Generals/Code/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
@@ -349,7 +349,6 @@ void W3DTreeBuffer::loadTreesInVertexAndIndexBuffers(RefRenderObjListIterator *p
 		}
 
 		Real typeOffset = type*0.5;
-		Int startVertex = m_curNumTreeVertices;
 		Int i, j;
 		Int numVertex = m_typeMesh[type]->Peek_Model()->Get_Vertex_Count();
 		Vector3 *pVert = m_typeMesh[type]->Peek_Model()->Get_Vertex_Array();
@@ -363,6 +362,8 @@ void W3DTreeBuffer::loadTreesInVertexAndIndexBuffers(RefRenderObjListIterator *p
 			break;
 		}
 
+		Int startVertex = m_curNumTreeVertices;
+
 		const Vector2*uvs=m_typeMesh[type]->Get_Model()->Get_UV_Array_By_Index(0);
 
 		// If we are doing reduced resolution terrain, do reduced