From 4c9b69af5f0ac30866a7cff91e815b80a4fe3ad7 Mon Sep 17 00:00:00 2001 From: Alibek Omarov Date: Wed, 16 Jul 2025 23:42:27 +0500 Subject: [PATCH] engine: mod_bmodel: allow firstclipnode index to be negative, as maps compiled with it rely on this trick by encoding whole hull as empty contents --- engine/common/mod_bmodel.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/engine/common/mod_bmodel.c b/engine/common/mod_bmodel.c index 290d5505..c232c9b7 100644 --- a/engine/common/mod_bmodel.c +++ b/engine/common/mod_bmodel.c @@ -1775,7 +1775,9 @@ static void Mod_SetupHull( dbspmodel_t *bmod, model_t *mod, int headnode, int hu hull->planes = mod->planes; // some map "optimizers" (you know who you are!) put -1 here - hull->firstclipnode = Q_max( 0, headnode ); + // ... and it's purposefully? encode CONTENTS_EMPTY sometimes + // but might cause out of bounds reads + hull->firstclipnode = headnode; hull->lastclipnode = mod->numclipnodes - 1; // only allocate clipnodes array for the base model, only for first hull