Buffer overflow renderergl2/tr_bsp.c:2306

[ioquake]

Buffer overflow renderergl2/tr_bsp.c:2306

[wtfbbqhax]

Squinting a little harder- I see ParseMesh assigns out->data and its always assumed to be a srfBspSurface_t on return- however, in this case, it's being assigned to static surfaceType_t skipData = SF_SKIP;.

So I am thinking that this change might be appropriate.

@@ -2299,6 +2299,9 @@ static    void R_LoadSurfaces( lump_t *surfs, lump_t *verts, lump_t *indexLump ) {
        switch ( LittleLong( in->surfaceType ) ) {
        case MST_PATCH:
            ParseMesh ( in, dv, hdrVertColors, out );
+
+          surfaceType_t type = *(surfaceType_t*)out->data;
+            if ( type != SF_SKIP )
            {
                srfBspSurface_t *surface = (srfBspSurface_t *)out->data;

This seems to work and it does prevent the memory corruption noted by address sanitizer.

Should I submit a PR?

[wtfbbqhax]

😩
Finally realize that this is fixed in ioquake/ioq3 and that I need to merge with upstream. :