From f5c0f8d66479a7e64e580cdf0fc2cf536e645ee1 Mon Sep 17 00:00:00 2001
From: "seer-by-sentry[bot]"
 <157164994+seer-by-sentry[bot]@users.noreply.github.com>
Date: Thu, 16 Apr 2026 03:27:22 +0000
Subject: [PATCH] bugfix(worldheightmap): Validate tile indices to prevent
 out-of-bounds access

---
 .../Source/W3DDevice/GameClient/WorldHeightMap.cpp             | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Core/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp b/Core/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp
index 3119deae2aa..d0a87d3a13a 100644
--- a/Core/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp
+++ b/Core/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp
@@ -527,6 +527,9 @@ WorldHeightMap::WorldHeightMap(ChunkInputStream *pStrm, Bool logicalDataOnly):
 			if (m_extraBlendTileNdxes[i]<0 || m_extraBlendTileNdxes[i]>= m_numBlendedTiles) {
 				m_extraBlendTileNdxes[i] = 0;
 			}
+			if (m_tileNdxes[i] < 0 || (m_tileNdxes[i] >> 2) >= NUM_SOURCE_TILES) {
+				m_tileNdxes[i] = 0;
+			}
 		}
 	}
 	if (TheGlobalData && TheGlobalData->m_drawEntireTerrain) {