From 4e4a54ab682227535c6e15ce5c9667528471607a Mon Sep 17 00:00:00 2001 From: Alibek Omarov Date: Sat, 16 May 2026 12:21:46 +0500 Subject: [PATCH] engine: despite byte-swapping code is no-op on little endian, it still fires and can read out of bounds on some models, leading to crash --- engine/common/mod_studio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/engine/common/mod_studio.c b/engine/common/mod_studio.c index e3f4269d..fa290448 100644 --- a/engine/common/mod_studio.c +++ b/engine/common/mod_studio.c @@ -997,7 +997,6 @@ static int Mod_StudioBodyVariations( model_t *mod ) static qboolean Mod_SwapStudioModel( const char *name, void *buffer, size_t buffersize ) { studiohdr_t *phdr = buffer; - byte *mod_base = buffer; if( buffersize < sizeof( studiohdr_t )) return false; @@ -1008,12 +1007,13 @@ static qboolean Mod_SwapStudioModel( const char *name, void *buffer, size_t buff return false; #if XASH_BIG_ENDIAN + byte *mod_base = buffer; + if( phdr->studiohdr2index > 0 && phdr->studiohdr2index < phdr->length ) { Con_Printf( S_ERROR "byteswapping extended studio model \"%s\" is unsupoprted\n", name ); return false; } -#endif for( int i = 0; i < phdr->numbones; i++ ) le_struct_swap( mstudiobone_swap, (mstudiobone_t *)( mod_base + phdr->boneindex ) + i ); @@ -1088,6 +1088,7 @@ static qboolean Mod_SwapStudioModel( const char *name, void *buffer, size_t buff short *pskinref = (short *)( mod_base + phdr->skinindex ); for( int i = 0; i < phdr->numskinfamilies * phdr->numskinref; i++ ) pskinref[i] = LittleShort( pskinref[i] ); +#endif return true; }