From ac3ba516e5bc61da1f044dfa1fff7e12a38326ba Mon Sep 17 00:00:00 2001
From: aglab2 <denis.kopyrin@phystech.edu>
Date: Sun, 8 Jul 2018 14:24:17 +0300
Subject: [PATCH 1/2] Extra sanity check for tmp texture validity

---
 src/Scripts/Fast3DScripts.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Scripts/Fast3DScripts.cs b/src/Scripts/Fast3DScripts.cs
index 61a8e1a..0d734c5 100644
--- a/src/Scripts/Fast3DScripts.cs
+++ b/src/Scripts/Fast3DScripts.cs
@@ -219,7 +219,7 @@ private static void switchTextureStatus(ref Model3D mdl, ref TempMaterial temp,
                 {
                     if (!mdl.builder.hasTexture(temp.segOff))
                     {
-                        if (temp.segOff != 0)
+                        if (temp.segOff != 0 && temp.w != 0 && temp.h != 0)
                         {
                             mdl.builder.AddTexture(
                                 TextureFormats.decodeTexture(

From 5e916c6c1c8ecaa9edc95fe031692329f9333465 Mon Sep 17 00:00:00 2001
From: aglab2 <denis.kopyrin@phystech.edu>
Date: Sun, 8 Jul 2018 14:35:00 +0300
Subject: [PATCH 2/2] More segment descriptors sanity checks

---
 src/ROM.cs | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/ROM.cs b/src/ROM.cs
index 8afab6a..56cc6e2 100644
--- a/src/ROM.cs
+++ b/src/ROM.cs
@@ -308,7 +308,7 @@ public void setSegment(uint index, uint segmentStart, uint segmentEnd, bool isMI
 
         public void setSegment(uint index, uint segmentStart, uint segmentEnd, bool isMIO0, bool fakeMIO0, uint uncompressedOffset)
         {
-            if (segmentStart > segmentEnd)
+            if (segmentStart > segmentEnd || index > segData.Length)
                 return;
 
             if (!isMIO0)
@@ -344,6 +344,9 @@ public byte[] getROMSection(uint start, uint end)
 
         public byte[] cloneSegment(byte segment)
         {
+            if (segment > segData.Length)
+                return null;
+
             byte[] copy = new byte[segData[segment].Length];
             Array.Copy(segData[segment], copy, segData[segment].Length);
             return copy;
@@ -351,11 +354,17 @@ public byte[] cloneSegment(byte segment)
 
         public byte[] getSegment(ushort seg)
         {
+            if (seg > segData.Length)
+                return null;
+
             return segData[seg];
         }
 
         public uint getSegmentStart(ushort seg)
         {
+            if (seg > segData.Length)
+                return 0;
+
             return segStart[seg];
         }
 
@@ -371,6 +380,9 @@ public uint decodeSegmentAddress(uint segOffset)
 
         public uint decodeSegmentAddress(byte segment, uint offset)
         {
+            if (segment > segData.Length)
+                return 0;
+
             if (segIsMIO0[segment])
                 throw new System.ArgumentException("Cannot decode segment address (0x" + segment.ToString("X2") + offset.ToString("X6") + ") from MIO0 data. (decodeSegmentAddress 2)");
             return segStart[segment] + offset;
@@ -389,6 +401,9 @@ public uint decodeSegmentAddress_safe(uint segOffset)
 
         public uint decodeSegmentAddress_safe(byte segment, uint offset)
         {
+            if (segment > segIsMIO0.Length)
+                return 0;
+
             if (segIsMIO0[segment])
                 return 0xFFFFFFFF;
             return segStart[segment] + offset;