From 8a7e96f7a631135decdcbd46e7038391439bf9bb Mon Sep 17 00:00:00 2001
From: kaetemi <jan.boon@kaetemi.be>
Date: Fri, 4 Jun 2021 18:59:46 +0800
Subject: [PATCH] Fix crash with bad `parts[next]` index

---
 nel/src/gui/css_style.cpp | 51 +++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 24 deletions(-)

diff --git a/nel/src/gui/css_style.cpp b/nel/src/gui/css_style.cpp
index 01bd812f1..e4a9751fa 100644
--- a/nel/src/gui/css_style.cpp
+++ b/nel/src/gui/css_style.cpp
@@ -1039,36 +1039,39 @@ namespace NLGUI
 						// second loop -> false && break
 						loop = !loop;
 
-						val = toLowerAscii(parts[next]);
-						if (val == "center")
-						{
-							if (bgPositionX.empty()) bgPositionX = "center";
-							if (bgPositionY.empty()) bgPositionY = "center";
-							// consume 'center'
-							next++;
-						}
-						else if (val == "left" || val == "right")
+						if (next < parts.size())
 						{
-							bgPositionX = val;
-							// consume 'left|right'
-							next++;
-							if(next < parts.size() && getCssLength(fval, unit, parts[next]))
+							val = toLowerAscii(parts[next]);
+							if (val == "center")
 							{
-								bgPositionX += " " + toString("%.0f%s", fval, unit.c_str());
-								// consume css length
+								if (bgPositionX.empty()) bgPositionX = "center";
+								if (bgPositionY.empty()) bgPositionY = "center";
+								// consume 'center'
 								next++;
 							}
-						}
-						else if (val == "top" || val == "bottom")
-						{
-							bgPositionY = val;
-							// consume top|bottom
-							next++;
-							if (next < parts.size() && getCssLength(fval, unit, parts[next]))
+							else if (val == "left" || val == "right")
 							{
-								bgPositionY += " " + toString("%.0f%s", fval, unit.c_str());
-								// consume css length
+								bgPositionX = val;
+								// consume 'left|right'
 								next++;
+								if (next < parts.size() && getCssLength(fval, unit, parts[next]))
+								{
+									bgPositionX += " " + toString("%.0f%s", fval, unit.c_str());
+									// consume css length
+									next++;
+								}
+							}
+							else if (val == "top" || val == "bottom")
+							{
+								bgPositionY = val;
+								// consume top|bottom
+								next++;
+								if (next < parts.size() && getCssLength(fval, unit, parts[next]))
+								{
+									bgPositionY += " " + toString("%.0f%s", fval, unit.c_str());
+									// consume css length
+									next++;
+								}
 							}
 						}
 					} while (loop);