Fix a bug that unloaded studiomodel structures were sometimes used by…

… StudioDrawVBO.

Plugins/Renderer/gl_studio.cpp

@@ -220,7 +220,8 @@ void R_PrepareStudioVBOSubmodel(
 					vIndices.emplace_back(iStartVertex + iNumVertex);
 					VBOMesh.iIndiceCount++;
 					VBOMesh.iPolyCount++;
-					VBOMesh.mesh = pmesh;
+					//VBOMesh.mesh = pmesh;
+					VBOMesh.iMeshIndex = k;
 
 					if (first == -1)
 						first = iNumVertex;
@@ -260,7 +261,8 @@ void R_PrepareStudioVBOSubmodel(
 					vIndices.emplace_back(iStartVertex + iNumVertex);
 					VBOMesh.iIndiceCount++;
 					VBOMesh.iPolyCount++;
-					VBOMesh.mesh = pmesh;
+					//VBOMesh.mesh = pmesh;
+					VBOMesh.iMeshIndex = k;
 
 					iNumTri++;
 
@@ -340,7 +342,9 @@ studio_vbo_t* R_PrepareStudioVBO(studiohdr_t* studiohdr)
 				auto submodel = (mstudiomodel_t*)((byte*)studiohdr + bodypart->modelindex) + j;
 
 				studio_vbo_submodel_t* vboSubmodel = new studio_vbo_submodel_t;
-				vboSubmodel->submodel = submodel;
+				//vboSubmodel->submodel = submodel;
+
+				vboSubmodel->iSubmodelIndex = j;
 
 				R_PrepareStudioVBOSubmodel(studiohdr, submodel, vVertex, vIndices, vboSubmodel);
 
@@ -1882,6 +1886,7 @@ void R_StudioDrawVBOMesh_AnalyzePass(
 	studio_vbo_t* VBOData,
 	studio_vbo_submodel_t* VBOSubmodel,
 	studio_vbo_mesh_t* VBOMesh,
+	mstudiomesh_t* pmesh,
 	studiohdr_t* ptexturehdr,
 	mstudiotexture_t* ptexture,
 	short* pskinref,
@@ -1936,13 +1941,12 @@ void R_StudioDrawVBOMesh_DrawPass(
 	studio_vbo_t* VBOData,
 	studio_vbo_submodel_t* VBOSubmodel,
 	studio_vbo_mesh_t* VBOMesh,
+	mstudiomesh_t* pmesh,
 	studiohdr_t* ptexturehdr,
 	mstudiotexture_t* ptexture,
 	short* pskinref,
 	const int flags)
 {
-	auto pmesh = VBOMesh->mesh;
-
 	program_state_t StudioProgramState = flags;
 
 	if (r_draw_shadowcaster)
@@ -2337,12 +2341,11 @@ void R_StudioDrawVBOMesh(
 	studio_vbo_t* VBOData,
 	studio_vbo_submodel_t* VBOSubmodel,
 	studio_vbo_mesh_t* VBOMesh,
+	mstudiomesh_t*pmesh,
 	studiohdr_t* ptexturehdr,
 	mstudiotexture_t* ptexture,
 	short* pskinref)
 {
-	auto pmesh = VBOMesh->mesh;
-
 	int flags = ptexture[pskinref[pmesh->skinref]].flags;
 
 	//Lighting related flags are ignored when r_fullbright >= 2
@@ -2378,6 +2381,7 @@ void R_StudioDrawVBOMesh(
 		R_StudioDrawVBOMesh_AnalyzePass(VBOData,
 			VBOSubmodel,
 			VBOMesh,
+			pmesh,
 			ptexturehdr,
 			ptexture,
 			pskinref,
@@ -2388,6 +2392,7 @@ void R_StudioDrawVBOMesh(
 		R_StudioDrawVBOMesh_DrawPass(VBOData,
 			VBOSubmodel,
 			VBOMesh,
+			pmesh,
 			ptexturehdr,
 			ptexture,
 			pskinref,
@@ -2406,7 +2411,9 @@ void R_StudioDrawVBOSubmodel(
 	{
 		auto VBOMesh = &VBOSubmodel->vMesh[i];
 
-		R_StudioDrawVBOMesh(VBOData, VBOSubmodel, VBOMesh, ptexturehdr, ptexture, pskinref);
+		auto pmesh = (mstudiomesh_t*)((byte*)(*pstudiohdr) + (*psubmodel)->meshindex) + VBOMesh->iMeshIndex;
+
+		R_StudioDrawVBOMesh(VBOData, VBOSubmodel, VBOMesh, pmesh, ptexturehdr, ptexture, pskinref);
 	}
 }
 

Plugins/Renderer/gl_studio.h

@@ -98,13 +98,14 @@ typedef struct studio_vbo_mesh_s
 {
 	studio_vbo_mesh_s()
 	{
-		mesh = NULL;
+		iMeshIndex = -1;
+		//memset(&mesh, 0, sizeof(mesh));
 		iStartIndex = -1;
 		iIndiceCount = 0;
 		iPolyCount = 0;
 	}
-
-	mstudiomesh_t *mesh;
+	int iMeshIndex;
+	//mstudiomesh_t mesh;
 	int iStartIndex;
 	int iIndiceCount;
 	int iPolyCount;
@@ -114,9 +115,11 @@ typedef struct studio_vbo_submodel_s
 {
 	struct studio_vbo_submodel_s()
 	{
-		submodel = NULL;
+		//memset(&submodel, 0, sizeof(submodel));
+		iSubmodelIndex = -1;
 	}
-	mstudiomodel_t *submodel;
+	//mstudiomodel_t submodel;
+	int iSubmodelIndex;
 	std::vector<studio_vbo_mesh_t> vMesh;
 }studio_vbo_submodel_t;
 

toolsrc/studiocheck/studiocheck.cpp

@@ -100,6 +100,7 @@ int main(int argc, const char **argv)
 		{
 			auto pal = (byte *)buffer + ptexture[i].index;
 			auto palsize = (ptexture[i].height * ptexture[i].width);
+
 			if (pal + palsize < (byte *)buffer)
 			{
 				printf("Error: invalid texturedata at texture[%d], (%p < %p)\n", i, pal + palsize, (byte *)buffer);
@@ -113,6 +114,45 @@ int main(int argc, const char **argv)
 				free(buffer);
 				return 0;
 			}
+
+		}
+
+		printf("numskinfamilies %d\n", studiohdr->numskinfamilies);
+		printf("numskinref %d\n", studiohdr->numskinref);
+
+		auto pskinref = (short*)((byte*)studiohdr + studiohdr->skinindex);
+
+		for (int i = 0; i < studiohdr->numskinfamilies; ++i)
+		{
+			pskinref += i * studiohdr->numskinref;
+
+			if ((byte*)pskinref < (byte*)buffer)
+			{
+				printf("Error: invalid pskinref at pskinref[%d], (%p < %p)\n", i, pskinref, (byte*)buffer);
+				free(buffer);
+				return 0;
+			}
+
+			if (((byte*)pskinref + sizeof(short) * studiohdr->numskinref) > (byte*)buffer + studiohdr->length)
+			{
+				printf("Error: invalid pskinref at pskinref[%d], (%p > %p)\n", i, ((byte*)pskinref + sizeof(short)), (byte*)buffer + studiohdr->length);
+				free(buffer);
+				return 0;
+			}
+
+			for (int j = 0; j < studiohdr->numskinref; ++j)
+			{
+				auto skinref = pskinref[j];
+
+				printf("skinref[%d][%d]=%d\n", i, j, skinref);
+
+				if (skinref < 0 || skinref >= studiohdr->numtextures)
+				{
+					printf("Error: invalid skinref value (%d) at pskinref[%d][%d]\n", skinref, i, j);
+					free(buffer);
+					return 0;
+				}
+			}
 		}
 	}
 
@@ -169,6 +209,20 @@ int main(int argc, const char **argv)
 				return 0;
 			}
 
+			for (int k = 0; k < psubmodel[j].nummesh; ++k)
+			{
+				auto skinref = pmesh[k].skinref;
+
+				printf("skinref value = (%d) at pmesh[%d].skinref\n", skinref, k);
+
+				if (skinref < 0 || skinref >= studiohdr->numtextures)
+				{
+					printf("Error: invalid skinref value (%d) at pmesh[%d].skinref\n", skinref, k);
+					free(buffer);
+					return 0;
+				}
+			}
+
 			for (int k = 0; k < psubmodel[j].nummesh; ++k)
 			{
 				auto ptricmds = (short *)((byte *)studiohdr + pmesh[k].triindex);