From 2c20734ad3605295cac0f42e0f3d1740a437d889 Mon Sep 17 00:00:00 2001 From: Max Parry <66670928+Buggem@users.noreply.github.com> Date: Sat, 6 Dec 2025 19:41:46 +1100 Subject: [PATCH] ref: soft: Fix out of bounds memory access in VID_ScreenShot --- ref/soft/r_glblit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ref/soft/r_glblit.c b/ref/soft/r_glblit.c index 6aa21909..6a83c349 100644 --- a/ref/soft/r_glblit.c +++ b/ref/soft/r_glblit.c @@ -861,7 +861,7 @@ qboolean GAME_EXPORT VID_ScreenShot( const char *filename, int shot_type ) for( v = 0; v < vid.height; v++ ) { - uint start = vid.rowbytes * ( vid.height - v ); + uint start = vid.rowbytes * ( vid.height - v - 1 ); uint d = swblit.stride - v - 1; for( u = 0; u < vid.width; u++ ) @@ -877,7 +877,7 @@ qboolean GAME_EXPORT VID_ScreenShot( const char *filename, int shot_type ) for( v = 0; v < vid.height; v++ ) { - uint start = vid.rowbytes * ( vid.height - v ); + uint start = vid.rowbytes * ( vid.height - v - 1 ); uint dstart = swblit.stride * v; for( u = 0; u < vid.width; u++ )