From 39c70072daa36c7ca995cc95bbd7e78503366743 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20K=C3=B6ppe?= <tkoeppe@google.com>
Date: Tue, 2 Aug 2016 09:48:04 +0100
Subject: [PATCH] [l_bsp_{q1,q2,sin}.c] Fix undefined behaviour in array access

---
 tools/mbspc/mbspc/l_bsp_q1.c  | 11 ++++++++---
 tools/mbspc/mbspc/l_bsp_q2.c  | 11 ++++++++---
 tools/mbspc/mbspc/l_bsp_sin.c | 11 ++++++++---
 3 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/tools/mbspc/mbspc/l_bsp_q1.c b/tools/mbspc/mbspc/l_bsp_q1.c
index d5c4990a..81b0ead2 100644
--- a/tools/mbspc/mbspc/l_bsp_q1.c
+++ b/tools/mbspc/mbspc/l_bsp_q1.c
@@ -227,7 +227,7 @@ Byte swaps all data in a bsp file.
 */
 void Q1_SwapBSPFile (qboolean todisk)
 {
-	int i, j, c;
+	int i, j, k, c;
 	q1_dmodel_t *d;
 	q1_dmiptexlump_t *mtl;
 
@@ -277,8 +277,13 @@ void Q1_SwapBSPFile (qboolean todisk)
 //	
 	for (i=0 ; i<q1_numtexinfo ; i++)
 	{
-		for (j=0 ; j<8 ; j++)
-			q1_texinfo[i].vecs[0][j] = LittleFloat(q1_texinfo[i].vecs[0][j]);
+		for (j=0 ; j<2 ; j++)
+		{
+			for (k=0; k<4; k++)
+			{
+				q1_texinfo[i].vecs[j][k] = LittleFloat (q1_texinfo[i].vecs[j][k]);
+			}
+		}
 		q1_texinfo[i].miptex = LittleLong(q1_texinfo[i].miptex);
 		q1_texinfo[i].flags = LittleLong(q1_texinfo[i].flags);
 	}
diff --git a/tools/mbspc/mbspc/l_bsp_q2.c b/tools/mbspc/mbspc/l_bsp_q2.c
index c465c183..56a535fd 100644
--- a/tools/mbspc/mbspc/l_bsp_q2.c
+++ b/tools/mbspc/mbspc/l_bsp_q2.c
@@ -642,7 +642,7 @@ Byte swaps all data in a bsp file.
 */
 void Q2_SwapBSPFile (qboolean todisk)
 {
-	int				i, j;
+	int				i, j, k;
 	dmodel_t		*d;
 
 	
@@ -688,8 +688,13 @@ void Q2_SwapBSPFile (qboolean todisk)
 //	
 	for (i=0 ; i<numtexinfo ; i++)
 	{
-		for (j=0 ; j<8 ; j++)
-			texinfo[i].vecs[0][j] = LittleFloat (texinfo[i].vecs[0][j]);
+		for (j=0 ; j<2 ; j++)
+		{
+			for (k=0; k<4; k++)
+			{
+				texinfo[i].vecs[j][k] = LittleFloat (texinfo[i].vecs[j][k]);
+			}
+		}
 		texinfo[i].flags = LittleLong (texinfo[i].flags);
 		texinfo[i].value = LittleLong (texinfo[i].value);
 		texinfo[i].nexttexinfo = LittleLong (texinfo[i].nexttexinfo);
diff --git a/tools/mbspc/mbspc/l_bsp_sin.c b/tools/mbspc/mbspc/l_bsp_sin.c
index 2c3c223c..35a72139 100644
--- a/tools/mbspc/mbspc/l_bsp_sin.c
+++ b/tools/mbspc/mbspc/l_bsp_sin.c
@@ -542,7 +542,7 @@ Byte swaps all data in a bsp file.
 */
 void Sin_SwapBSPFile (qboolean todisk)
 {
-	int				i, j;
+	int				i, j, k;
 	sin_dmodel_t		*d;
 
 	
@@ -588,8 +588,13 @@ void Sin_SwapBSPFile (qboolean todisk)
 //	
 	for (i = 0; i < sin_numtexinfo; i++)
 	{
-		for (j=0 ; j<8 ; j++)
-			sin_texinfo[i].vecs[0][j] = LittleFloat (sin_texinfo[i].vecs[0][j]);
+		for (j=0 ; j<2 ; j++)
+		{
+			for (k=0; k<4; k++)
+			{
+				sin_texinfo[i].vecs[j][k] = LittleFloat (sin_texinfo[i].vecs[j][k]);
+			}
+		}
 #ifdef SIN
       sin_texinfo[i].trans_mag = LittleFloat( sin_texinfo[i].trans_mag );     
       sin_texinfo[i].trans_angle = LittleLong( sin_texinfo[i].trans_angle );