diff --git a/Generals/Code/Libraries/Source/WWVegas/WW3D2/render2d.cpp b/Generals/Code/Libraries/Source/WWVegas/WW3D2/render2d.cpp index 1284870662a..b2445932ef7 100644 --- a/Generals/Code/Libraries/Source/WWVegas/WW3D2/render2d.cpp +++ b/Generals/Code/Libraries/Source/WWVegas/WW3D2/render2d.cpp @@ -532,6 +532,19 @@ void Render2DClass::Render(void) return; } + // Validate that all vertex data arrays have consistent sizes to prevent buffer overflow + int vertex_count = Vertices.Count(); + int uv_count = UVCoordinates.Count(); + int color_count = Colors.Count(); + + if (vertex_count != uv_count || vertex_count != color_count) { + // Arrays are out of sync - this is a critical error condition + // Reset to prevent rendering corrupted data + WWASSERT(0 && "Render2DClass vertex data arrays are out of sync"); + Reset(); + return; + } + // save the view and projection matrices since we're nuking them Matrix4x4 view,proj; Matrix4x4 identity(true); @@ -562,14 +575,14 @@ void Render2DClass::Render(void) DX8Wrapper::Set_View_Identity(); DX8Wrapper::Set_Transform(D3DTS_PROJECTION,identity); - DynamicVBAccessClass vb(BUFFER_TYPE_DYNAMIC_DX8,dynamic_fvf_type,Vertices.Count()); + DynamicVBAccessClass vb(BUFFER_TYPE_DYNAMIC_DX8,dynamic_fvf_type,vertex_count); { DynamicVBAccessClass::WriteLockClass Lock(&vb); const FVFInfoClass &fi=vb.FVF_Info(); unsigned char *vb=(unsigned char*)Lock.Get_Formatted_Vertex_Array(); int i; - for (i=0; i