From 0da019dcc3db00d61a5202887d33221d14e07818 Mon Sep 17 00:00:00 2001
From: Vicki Pfau <vi@endrift.com>
Date: Sun, 19 Jul 2020 15:36:34 -0700
Subject: [PATCH] DS GX: Reject and log polygons that clip to more than 10
 vertices

---
 CHANGES     | 1 +
 src/ds/gx.c | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/CHANGES b/CHANGES
index 7af5e7f6e..ffd4dc87a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -18,6 +18,7 @@ Misc:
  - DS GX: Clean up and unify texture mapping
  - DS Core: Add symbol loading
  - DS Video: Simplify VRAM mapping
+ - DS GX: Reject and log polygons that clip to more than 10 vertices
 
 0.9.0: (Future)
 Features:
diff --git a/src/ds/gx.c b/src/ds/gx.c
index 304a93c38..8ee9d287a 100644
--- a/src/ds/gx.c
+++ b/src/ds/gx.c
@@ -335,6 +335,10 @@ static bool _clipPolygon(struct DSGX* gx, struct DSGXPolygon* poly) {
 	for (plane = 5; plane >= 0; --plane) {
 		newV = 0;
 		for (v = 0; v < poly->verts; ++v) {
+			if (newV >= 10) {
+				mLOG(DS_GX, ERROR, "Polygon clipping invariant failed");
+				return false;
+			}
 			if (!(offscreenVerts[v] & (1 << plane))) {
 				outList[newV] = inList[v];
 				outOffscreenVerts[newV] = offscreenVerts[v];