From 00e17c0e1fe95a922957ba5e458c2ab514cd3650 Mon Sep 17 00:00:00 2001
From: Fabian Greffrath <fabian@greffrath.com>
Date: Fri, 10 Jan 2020 15:36:52 +0100
Subject: [PATCH] pad the REJECT table when the lump is too small

This reverts the previous commit which only handled the case of an
absent REJECT table. No attempts are made to simulate REJECT buffer
overflows in Vanilla Doom, because MBF is a different EXE anyway.
---
 Source/p_setup.c | 44 +++++++++++++++++++++++++++++++++++++++++++-
 Source/p_sight.c |  4 ----
 2 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/Source/p_setup.c b/Source/p_setup.c
index b8145ed0..58c7bcd1 100644
--- a/Source/p_setup.c
+++ b/Source/p_setup.c
@@ -936,6 +936,47 @@ void P_RemoveSlimeTrails(void)                // killough 10/98
   free(hit);
 }
 
+// [FG] pad the REJECT table when the lump is too small
+
+static void P_LoadReject(int lumpnum)
+{
+    int minlength;
+    int lumplen;
+
+    // Calculate the size that the REJECT lump *should* be.
+
+    minlength = (numsectors * numsectors + 7) / 8;
+
+    // If the lump meets the minimum length, it can be loaded directly.
+    // Otherwise, we need to allocate a buffer of the correct size
+    // and pad it with appropriate data.
+
+    lumplen = W_LumpLength(lumpnum);
+
+    if (lumplen >= minlength)
+    {
+        rejectmatrix = W_CacheLumpNum(lumpnum, PU_LEVEL);
+    }
+    else
+    {
+        unsigned int padvalue;
+
+        rejectmatrix = Z_Malloc(minlength, PU_LEVEL, (void **) &rejectmatrix);
+        W_ReadLump(lumpnum, rejectmatrix);
+
+        if (M_CheckParm("-reject_pad_with_ff"))
+        {
+            padvalue = 0xff;
+        }
+        else
+        {
+            padvalue = 0xf00;
+        }
+
+        memset(rejectmatrix + lumplen, padvalue, minlength - lumplen);
+    }
+}
+
 //
 // P_SetupLevel
 //
@@ -992,7 +1033,8 @@ void P_SetupLevel(int episode, int map, int playermask, skill_t skill)
   P_LoadNodes     (lumpnum+ML_NODES);
   P_LoadSegs      (lumpnum+ML_SEGS);
 
-  rejectmatrix = W_CacheLumpNum(lumpnum+ML_REJECT,PU_LEVEL);
+  // [FG] pad the REJECT table when the lump is too small
+  P_LoadReject (lumpnum+ML_REJECT);
   P_GroupLines();
 
   P_RemoveSlimeTrails();    // killough 10/98: remove slime trails from wad
diff --git a/Source/p_sight.c b/Source/p_sight.c
index a75fd280..06e87d9a 100644
--- a/Source/p_sight.c
+++ b/Source/p_sight.c
@@ -224,12 +224,8 @@ boolean P_CheckSight(mobj_t *t1, mobj_t *t2)
   //
   // Check in REJECT table.
 
-  // [FG] fix crash when loading maps without REJECT table
-  if (rejectmatrix)
-  {
   if (rejectmatrix[pnum>>3] & (1 << (pnum&7)))   // can't possibly be connected
     return false;
-  }
 
   // killough 4/19/98: make fake floors and ceilings block monster view
   if ((s1->heightsec != -1 &&