From c81dc7bd557115bdaabc16516de0380271cfe561 Mon Sep 17 00:00:00 2001
From: LunaMoo <moo@moo.moo>
Date: Tue, 24 Jan 2017 02:33:16 +0100
Subject: [PATCH 1/2] Limit Projection Matrix Data count to <= 16

---
 GPU/GPUCommon.cpp | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/GPU/GPUCommon.cpp b/GPU/GPUCommon.cpp
index b62f888b2a..92bd2a8f30 100644
--- a/GPU/GPUCommon.cpp
+++ b/GPU/GPUCommon.cpp
@@ -1296,7 +1296,7 @@ void GPUCommon::Execute_ProjMtxNum(u32 op, u32 diff) {
 	}
 
 	const int count = i;
-	gstate.projmtxnum = (GE_CMD_PROJMATRIXNUMBER << 24) | ((op + count) & 0xF);
+	gstate.projmtxnum = (GE_CMD_PROJMATRIXNUMBER << 24) | ((op + count) & 0x1F);
 
 	// Skip over the loaded data, it's done now.
 	UpdatePC(currentList->pc, currentList->pc + count * 4);
@@ -1305,15 +1305,16 @@ void GPUCommon::Execute_ProjMtxNum(u32 op, u32 diff) {
 
 void GPUCommon::Execute_ProjMtxData(u32 op, u32 diff) {
 	// Note: it's uncommon to get here now, see above.
-	int num = gstate.projmtxnum & 0xF;
+	int num = gstate.projmtxnum & 0x1F;    // NOTE: Changed from 0xF to catch overflows
 	u32 newVal = op << 8;
-	if (newVal != ((const u32 *)gstate.projMatrix)[num]) {
+	if (num < 0x10 && newVal != ((const u32 *)gstate.projMatrix)[num]) {
 		Flush();
 		((u32 *)gstate.projMatrix)[num] = newVal;
 		shaderManager_->DirtyUniform(DIRTY_PROJMATRIX);
 	}
 	num++;
-	gstate.projmtxnum = (GE_CMD_PROJMATRIXNUMBER << 24) | (num & 0xF);
+	if (num <= 16)
+		gstate.projmtxnum = (GE_CMD_PROJMATRIXNUMBER << 24) | (num & 0xF);
 }
 
 void GPUCommon::Execute_TgenMtxNum(u32 op, u32 diff) {

From e0aaba5448f00fa5951d499f8385d13d0d3b1fe2 Mon Sep 17 00:00:00 2001
From: LunaMoo <moo@moo.moo>
Date: Thu, 1 Dec 2016 23:14:41 +0100
Subject: [PATCH 2/2] Also fix SoftGPU

---
 GPU/Software/SoftGpu.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/GPU/Software/SoftGpu.cpp b/GPU/Software/SoftGpu.cpp
index 2ee1773785..ee2f651bc2 100644
--- a/GPU/Software/SoftGpu.cpp
+++ b/GPU/Software/SoftGpu.cpp
@@ -707,14 +707,15 @@ void SoftGPU::ExecuteOp(u32 op, u32 diff) {
 		break;
 
 	case GE_CMD_PROJMATRIXNUMBER:
-		gstate.projmtxnum = data & 0xF;
+		gstate.projmtxnum = data & 0x1F;
 		break;
 
 	case GE_CMD_PROJMATRIXDATA:
 		{
-			int num = gstate.projmtxnum & 0xF;
+			int num = gstate.projmtxnum & 0x1F; // NOTE: Changed from 0xF to catch overflows
 			gstate.projMatrix[num] = getFloat24(data);
-			gstate.projmtxnum = (++num) & 0xF;
+			if (num <= 16)
+				gstate.projmtxnum = (++num) & 0x1F;
 		}
 		break;