[Fixed] Fatal Crash When FountainColor var Wraps Below 0 To 255

[22alpha22]

I managed to get GZDoom to reliably crash while doing some experimenting with a few actor variables related to this post: viewtopic.php?f=122&t=75662
For some reason whenever the FountainColor actor variable is wrapped back around to 255 after being subtracted from 0, GZDoom immediately crashes. I thought it might at first be a problem with UInt8s but other UInt8s such as SmokeCounter are able to wrap around without issue.

I've attached a crash report as well as a simple test wad. Load the wad with any iwad that has a Doom Imp and summon a "FountainImp", simply shoot the Imp and it's FountainColor var will begin decreasing by 1 per tick triggering a crash when it attempts to wrap around to 255.

[Player701]

This field is used as a sole indicator that the actor is a particle fountain, which gets activated when the value is non-zero (no flags or special properties are required). It is therefore inadvisable to use FountainColor for anything else. There is still a bug here, however, because the value is used to index a static array without proper range checking, which results in undefined behavior (manifesting as a crash).

[Graf Zahl]

fixed