From 29884e2b4acb23db0b70070627098725e0c400d3 Mon Sep 17 00:00:00 2001
From: Eric Wasylishen <ewasylishen@gmail.com>
Date: Sat, 18 Mar 2017 16:16:06 -0600
Subject: [PATCH] bsputils: add bounds checking to Face_GetNum

---
 common/bsputils.cc | 8 +++++++-
 light/ltface.cc    | 2 +-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/common/bsputils.cc b/common/bsputils.cc
index 23ad72a8..19671516 100644
--- a/common/bsputils.cc
+++ b/common/bsputils.cc
@@ -19,12 +19,18 @@
 
 #include <common/bsputils.hh>
 #include <assert.h>
+#include <cstddef>
 
 #include <glm/glm.hpp>
 
 int Face_GetNum(const bsp2_t *bsp, const bsp2_dface_t *f)
 {
-    return f - bsp->dfaces;
+    Q_assert(f != nullptr);
+    
+    const ptrdiff_t diff = f - bsp->dfaces;
+    Q_assert(diff >= 0 && diff < bsp->numfaces);
+    
+    return static_cast<int>(diff);
 }
 
 /* small helper that just retrieves the correct vertex from face->surfedge->edge lookups */
diff --git a/light/ltface.cc b/light/ltface.cc
index bc98dc73..6f6d5e4e 100644
--- a/light/ltface.cc
+++ b/light/ltface.cc
@@ -664,7 +664,7 @@ CalcPoints(const modelinfo_t *modelinfo, const vec3_t offset, lightsurf_t *surf,
             const auto res = CalcPointNormal(bsp, face, vec3_t_to_glm(point), phongshaded, surf->lightmapscale, 0);
             
             surf->occluded[i] = !get<0>(res);
-            *realfacenum = Face_GetNum(bsp, std::get<1>(res));
+            *realfacenum = std::get<1>(res) != nullptr ? Face_GetNum(bsp, std::get<1>(res)) : -1;
             glm_to_vec3_t(std::get<2>(res), point);
             glm_to_vec3_t(std::get<3>(res), norm);