@metlslime, @mh :

I was reported a stack buffer overrun in Mod_PolyForUnlitSurface
https://github.com/sezero/quakespasm/issues/100
Fixed easily by removing the hardcoded local verts and inlining
'convert edges back to a normal polygon' code into poly creation
as shown in the patch in there.

However, a similar local copy to a hardcoded local verts[64] is
also in GL_SubdivideSurface, and the same trick can not apply to
it. Its subroutine SubdividePolygon() checks for numverts > 60
and errors out if it is so, but GL_SubdivideSurface itself does
not check before copying to the stack buffer verts[64]: What is
a good solution here? Easy way out by erroring out if fa->polys->
numverts > 64 ?? 

I don't see an easy way to remove the arrays, since it's recursively creating new arrays as it goes. You could throw an error in GL_SubdivideSurface like you suggested. or do a warning and drop all of the remaining verts (leaving an incomplete polygon.) 

OK, will throw an error. Thank you. 

if surfaces are always convex polygons, GL_SubdivideSurface can pre-divide it into a number of “triangle fan” parts. that could be done inline by messing with the vertex array in place and keeping track and fixing it up as you go. then youre only sending safe data into the recursive function. 

If you can send me a patch (sezeroz _at_ gmail _dot_com) I can
gladly test and include it in the next release. If not, well, we
have never hit a stack overrun in GL_SubdivideSurface so far and
this was just a safeguard anyway. Thanks. 

Version 0.96.2 of QuakeSpasm is released.

Downloads:
https://sourceforge.net/projects/quakespasm/files/
http://quakespasm.sourceforge.net/download.htm

Changes since the previous version:

- Fix stack buffer overrun Mod_PolyForUnlitSurface: fixes crash when
loading lim_daviddg.bsp from Liminal Spaces Jam.
- Fix potential buffer overflow in progs global string functions.
- Fix potential buffer overflow in Mod_LoadAliasFrame()
- Optimize BoxOnPlaneSide()
- Reserve enough space in PF_makestatic() for worst case scenarios.
- Improve handling of huge entities in SV_FindTouchedLeafs()
- Warn about bad maps with only 1 or 2 edges per face (e.g.: mj4m?,
alk_dancing, ej3_bizz, rotj_entsoy...)
- Apply FOV gun scaling for r_showtris
- Sliders with visible values in options menu.
- game command now refuses setting a non-existing game directory
- Fix build in C23 mode.
- Minor code cleanups. Updated third party code, e.g. SDL, music
codecs, etc.
- Thanks to Andrei Drexler, Alexey Lysiuk, Diordany van Hemert, and
Jaime Moreira for patches.