From c23f3fbd9fef98f8346f0939989f1089b276118d Mon Sep 17 00:00:00 2001
From: bank <bank@deelogic.net>
Date: Thu, 16 Oct 2014 19:23:10 +0400
Subject: [PATCH 1/3] Fix initializing return buffer.

Use "bufSize", not the "buf" itself.
---
 Engine/source/console/fileSystemFunctions.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Engine/source/console/fileSystemFunctions.cpp b/Engine/source/console/fileSystemFunctions.cpp
index 75b1ba9f7..b37a61386 100644
--- a/Engine/source/console/fileSystemFunctions.cpp
+++ b/Engine/source/console/fileSystemFunctions.cpp
@@ -696,7 +696,7 @@ DefineEngineFunction(makeFullPath, String, ( const char* path, const char* cwd )
 	"@ingroup FileSystem")
 {
    static const U32 bufSize = 512;
-   char *buf = Con::getReturnBuffer(buf);
+   char *buf = Con::getReturnBuffer(bufSize);
    Platform::makeFullPathName(path, buf, bufSize, dStrlen(cwd) > 1 ? cwd : NULL);
    return buf;
 }
@@ -723,7 +723,7 @@ DefineEngineFunction(pathConcat, String, ( const char* path, const char* file),,
 	"@ingroup FileSystem")
 {
    static const U32 bufSize = 1024;
-   char *buf = Con::getReturnBuffer(buf);
+   char *buf = Con::getReturnBuffer(bufSize);
    Platform::makeFullPathName(file, buf, bufSize, path);
    return buf;
 }

From d9c5670e935d79b18e5957a69f8be4e16fc04079 Mon Sep 17 00:00:00 2001
From: bank <bank@deelogic.net>
Date: Thu, 16 Oct 2014 19:39:25 +0400
Subject: [PATCH 2/3] Fix possible array overrun. We should clamp the index
 value to the size of the weaponMountNode[], which is
 ShapeBase::MaxMountedImages (4) and SceneObject::NumMountPoints = 31.

---
 Engine/source/T3D/turret/turretShape.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Engine/source/T3D/turret/turretShape.cpp b/Engine/source/T3D/turret/turretShape.cpp
index 5d53fabe8..b824d75cd 100644
--- a/Engine/source/T3D/turret/turretShape.cpp
+++ b/Engine/source/T3D/turret/turretShape.cpp
@@ -1155,7 +1155,7 @@ void TurretShape::unpackUpdate(NetConnection *connection, BitStream *stream)
 void TurretShape::getWeaponMountTransform( S32 index, const MatrixF &xfm, MatrixF *outMat )
 {
    // Returns mount point to world space transform
-   if ( index >= 0 && index < SceneObject::NumMountPoints) {
+   if ( index >= 0 && index < ShapeBase::MaxMountedImages) {
       S32 ni = mDataBlock->weaponMountNode[index];
       if (ni != -1) {
          MatrixF mountTransform = mShapeInstance->mNodeTransforms[ni];
@@ -1180,7 +1180,7 @@ void TurretShape::getWeaponMountTransform( S32 index, const MatrixF &xfm, Matrix
 void TurretShape::getRenderWeaponMountTransform( F32 delta, S32 mountPoint, const MatrixF &xfm, MatrixF *outMat )
 {
    // Returns mount point to world space transform
-   if ( mountPoint >= 0 && mountPoint < SceneObject::NumMountPoints) {
+   if ( mountPoint >= 0 && mountPoint < ShapeBase::MaxMountedImages) {
       S32 ni = mDataBlock->weaponMountNode[mountPoint];
       if (ni != -1) {
          MatrixF mountTransform = mShapeInstance->mNodeTransforms[ni];

From 62006e8b3c5971fd2fde47075ae43d4b6bd642a7 Mon Sep 17 00:00:00 2001
From: bank <bank@deelogic.net>
Date: Thu, 16 Oct 2014 19:39:54 +0400
Subject: [PATCH 3/3] Remove unneeded double-initialization of the vars.

---
 Engine/source/T3D/debris.cpp                      | 1 -
 Engine/source/materials/processedFFMaterial.cpp   | 2 +-
 Engine/source/renderInstance/renderBinManager.cpp | 1 -
 Engine/source/scene/simPath.cpp                   | 1 -
 4 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/Engine/source/T3D/debris.cpp b/Engine/source/T3D/debris.cpp
index 77d5fc603..d8ef4f8fa 100644
--- a/Engine/source/T3D/debris.cpp
+++ b/Engine/source/T3D/debris.cpp
@@ -99,7 +99,6 @@ DebrisData::DebrisData()
    friction   = 0.2f;
    numBounces = 0;
    bounceVariance = 0;
-   minSpinSpeed = maxSpinSpeed = 0.0;
    staticOnMaxBounce = false;
    explodeOnMaxBounce = false;
    snapOnMaxBounce = false;
diff --git a/Engine/source/materials/processedFFMaterial.cpp b/Engine/source/materials/processedFFMaterial.cpp
index 500783aee..1a1a4f9e5 100644
--- a/Engine/source/materials/processedFFMaterial.cpp
+++ b/Engine/source/materials/processedFFMaterial.cpp
@@ -368,7 +368,7 @@ void ProcessedFFMaterial::_initPassStateBlock( RenderPassData *rpd, GFXStateBloc
       result.blendDefined = true;
       result.blendEnable = true;
       result.blendSrc = GFXBlendOne;
-      result.blendSrc = GFXBlendOne;
+      result.blendDest = GFXBlendZero;
    }
 
    // This is here for generic FF shader fallbacks.
diff --git a/Engine/source/renderInstance/renderBinManager.cpp b/Engine/source/renderInstance/renderBinManager.cpp
index 5fb05eebf..df41b634c 100644
--- a/Engine/source/renderInstance/renderBinManager.cpp
+++ b/Engine/source/renderInstance/renderBinManager.cpp
@@ -122,7 +122,6 @@ void RenderBinManager::internalAddElement(RenderInst* inst)
    mElementList.increment();
    MainSortElem &elem = mElementList.last();
    elem.inst = inst;
-   elem.key = elem.key2 = 0;
 
    elem.key = inst->defaultKey;
    elem.key2 = inst->defaultKey2;
diff --git a/Engine/source/scene/simPath.cpp b/Engine/source/scene/simPath.cpp
index 1ab5677ec..c25764ad1 100644
--- a/Engine/source/scene/simPath.cpp
+++ b/Engine/source/scene/simPath.cpp
@@ -371,7 +371,6 @@ Marker::Marker()
    mTypeMask |= MarkerObjectType;
 
    mSeqNum   = 0;
-   mSmoothingType = SmoothingTypeLinear;
    mMSToNext = 1000;
    mSmoothingType = SmoothingTypeSpline;
    mKnotType = KnotTypeNormal;