From 6ae7eb31a647f090a4c493cba14a8972a8ee6d25 Mon Sep 17 00:00:00 2001
From: Chris Frey <cdfrey@foursquare.net>
Date: Sun, 15 Nov 2020 17:48:10 -0500
Subject: [PATCH] BucketBox: fixed possibility of writing one past the end of
 the given array

---
 simgear/scene/tgdb/BucketBox.hxx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/simgear/scene/tgdb/BucketBox.hxx b/simgear/scene/tgdb/BucketBox.hxx
index 8cc616ac..e0af7813 100644
--- a/simgear/scene/tgdb/BucketBox.hxx
+++ b/simgear/scene/tgdb/BucketBox.hxx
@@ -286,16 +286,16 @@ public:
                 continue;
       
             if (heightSplitBox.getWidthIsBucketSize()) {
+                assert(numTiles < bucketBoxListSize);
                 bucketBoxList[numTiles++] = heightSplitBox;
-                assert(numTiles <= bucketBoxListSize);
             } else {
                 for (unsigned i = 0; i < _lonFactors[widthLevel]; ++i) {
                     BucketBox childBox = _intersection(heightSplitBox, heightSplitBox.getSubBoxWidth(i, widthLevel + 1));
                     if (childBox.empty())
                         continue;
           
+                    assert(numTiles < bucketBoxListSize);
                     bucketBoxList[numTiles++] = childBox;
-                    assert(numTiles <= bucketBoxListSize);
                 }
             }
         }