From e4e50d7711401185fbcd40a56de8fcf946381cb2 Mon Sep 17 00:00:00 2001
From: Fabio Pedretti <fabio.ped@libero.it>
Date: Wed, 26 Aug 2026 11:48:27 +0200
Subject: [PATCH] MapReader: Reject maps with out-of-range terrain tile texture
 index

m_Tex1Index is unvalidated (raw .pmp bytes / RMS script) and was used
to index m_TerrainTextures with no bounds check.
---
 source/graphics/MapReader.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/source/graphics/MapReader.cpp b/source/graphics/MapReader.cpp
index 1b3c9fc2ba..a195f44375 100644
--- a/source/graphics/MapReader.cpp
+++ b/source/graphics/MapReader.cpp
@@ -358,6 +358,9 @@ int CMapReader::ApplyTerrainData()
 						for (ssize_t k=0; k<PATCH_SIZE; k++) {
 							CMiniPatch& mp = pTerrain->GetPatch(i,j)->m_MiniPatches[m][k];	// can't fail
 
+							if (tileptr->m_Tex1Index >= m_TerrainTextures.size())
+								throw PSERROR_Game_World_MapLoadFailed("Error loading map: terrain tile references an invalid texture index.\nCheck application log for details.");
+
 							mp.Tex = m_TerrainTextures[tileptr->m_Tex1Index];
 							mp.Priority = tileptr->m_Priority;