At the point at which this code appears, trnum can be negative. This is latent
and does not cause a segfault because the compiler simply calculates a memory
address to store into t, without doing any actual dereferences. However,
debugging #56 revealed this invalid reference, which is undefined behavior with
respect to the C standard.
traverse_polygon (int* visited, boxf* decomp, int size, segment_t* seg, trap_t* tr,
int mcur, int trnum, int from, int flip, int dir)
{
- trap_t *t = &tr[trnum];
+ trap_t *t;
int mnew;
int v0, v1;
int do_switch = FALSE;
if ((trnum <= 0) || visited[trnum])
return size;
+ t = &tr[trnum];
+
visited[trnum] = TRUE;
if ((t->hi.y > t->lo.y) &&