From 83cb4cc21089347b7df9f476586ed328be15e1f0 Mon Sep 17 00:00:00 2001 From: Brandon Arrendondo Date: Wed, 24 Jun 2026 10:38:08 -0400 Subject: [PATCH] [rlgl] Fix matrix stack overflow in rlPushMatrix() (#5935) The RL_MAX_MATRIX_STACK_SIZE check logged an error but did not return, so RLGL.State.stack[stackCounter] = *currentMatrix still executed when the stack was full -- writing one element past stack[RL_MAX_MATRIX_STACK_SIZE] and corrupting the adjacent RLGL.State members (stackCounter, etc.). rlPopMatrix() already guards the symmetric underflow case; add the missing early return. Co-authored-by: Brandon Arrendondo --- src/rlgl.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/rlgl.h b/src/rlgl.h index ed5e50fb1..8c529a4e0 100644 --- a/src/rlgl.h +++ b/src/rlgl.h @@ -1237,7 +1237,11 @@ void rlMatrixMode(int mode) // Push the current matrix into RLGL.State.stack void rlPushMatrix(void) { - if (RLGL.State.stackCounter >= RL_MAX_MATRIX_STACK_SIZE) TRACELOG(RL_LOG_ERROR, "RLGL: Matrix stack overflow (RL_MAX_MATRIX_STACK_SIZE)"); + if (RLGL.State.stackCounter >= RL_MAX_MATRIX_STACK_SIZE) + { + TRACELOG(RL_LOG_ERROR, "RLGL: Matrix stack overflow (RL_MAX_MATRIX_STACK_SIZE)"); + return; + } if (RLGL.State.currentMatrixMode == RL_MODELVIEW) {