From 37e2b94d3e5325612320023b30d4b57900411aaa Mon Sep 17 00:00:00 2001
From: Eric Wasylishen <ewasylishen@gmail.com>
Date: Thu, 19 Oct 2017 13:41:14 -0700
Subject: [PATCH] bsputils: add leafnum bounds check to Light_PointInSolid_r

---
 common/bsputils.cc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/common/bsputils.cc b/common/bsputils.cc
index dcb1de2b..117557db 100644
--- a/common/bsputils.cc
+++ b/common/bsputils.cc
@@ -220,7 +220,12 @@ vec_t Plane_Dist(const vec3_t point, const dplane_t *plane)
 static bool Light_PointInSolid_r(const mbsp_t *bsp, int nodenum, const vec3_t point )
 {
     if (nodenum < 0) {
-        mleaf_t *leaf = bsp->dleafs + (-1 - nodenum);
+		// FIXME: Factor out into bounds-checked getter
+		int leafnum = (-1 - nodenum);
+		if (leafnum < 0 || leafnum >= bsp->numleafs) {
+			Error("Corrupt BSP: leaf %d is out of bounds (bsp->numleafs = %d)", leafnum, bsp->numleafs);
+		}
+        mleaf_t *leaf = &bsp->dleafs[leafnum];
         
         return leaf->contents == CONTENTS_SOLID
         || leaf->contents == CONTENTS_SKY;