|  | @@ -343,8 +343,7 @@ static void sDereference(Script* sc) {
 | 
	
		
			
				|  |  |          return;
 | 
	
		
			
				|  |  |      }
 | 
	
		
			
				|  |  |      Value* v = sPushStack(sc, 1);
 | 
	
		
			
				|  |  | -    if(vSetType(v, VT_POINTER) ||
 | 
	
		
			
				|  |  | -       vSetOffset(v, (uint32)(address + sc->stackVarIndex))) {
 | 
	
		
			
				|  |  | +    if(vSetType(v, VT_POINTER) || vSetOffset(v, address + sc->stackVarIndex)) {
 | 
	
		
			
				|  |  |          sCannotSetValueType(sc);
 | 
	
		
			
				|  |  |          return;
 | 
	
		
			
				|  |  |      }
 | 
	
	
		
			
				|  | @@ -357,7 +356,7 @@ static void sGlobalDereference(Script* sc) {
 | 
	
		
			
				|  |  |          return;
 | 
	
		
			
				|  |  |      }
 | 
	
		
			
				|  |  |      Value* v = sPushStack(sc, 1);
 | 
	
		
			
				|  |  | -    if(vSetType(v, VT_POINTER) || vSetOffset(v, (uint32)address)) {
 | 
	
		
			
				|  |  | +    if(vSetType(v, VT_POINTER) || vSetOffset(v, address)) {
 | 
	
		
			
				|  |  |          sCannotSetValueType(sc);
 | 
	
		
			
				|  |  |          return;
 | 
	
		
			
				|  |  |      }
 | 
	
	
		
			
				|  | @@ -382,14 +381,14 @@ static void sAddReference(Script* sc) {
 | 
	
		
			
				|  |  |      }
 | 
	
		
			
				|  |  |      Value* v = sPeekStack(sc, VT_POINTER);
 | 
	
		
			
				|  |  |      if(v != NULL) {
 | 
	
		
			
				|  |  | -        if(vSetOffset(v, vGetOffset(*v) + (uint32)(add * size))) {
 | 
	
		
			
				|  |  | +        if(vSetOffset(v, vGetOffset(*v) + add * size)) {
 | 
	
		
			
				|  |  |              sCannotSetValueType(sc);
 | 
	
		
			
				|  |  |          }
 | 
	
		
			
				|  |  |      } else {
 | 
	
		
			
				|  |  |          sc->error[0] = '\0';
 | 
	
		
			
				|  |  |          v = sPeekStack(sc, VT_ARRAY);
 | 
	
		
			
				|  |  |          if(vSetType(v, VT_POINTER) ||
 | 
	
		
			
				|  |  | -           vSetOffset(v, vGetOffset(*v) + (uint32)(add * size))) {
 | 
	
		
			
				|  |  | +           vSetOffset(v, vGetOffset(*v) + add * size)) {
 | 
	
		
			
				|  |  |              sCannotSetValueType(sc);
 | 
	
		
			
				|  |  |          }
 | 
	
		
			
				|  |  |      }
 | 
	
	
		
			
				|  | @@ -412,10 +411,10 @@ static void sPushStructReference(Script* sc) {
 | 
	
		
			
				|  |  |  }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  static Value* sLoadFromPointer(Script* sc, Value* p, ValueType wantedType) {
 | 
	
		
			
				|  |  | -    uint32 offset = vGetOffset(*p);
 | 
	
		
			
				|  |  | +    int32 offset = vGetOffset(*p);
 | 
	
		
			
				|  |  |      if(p->data.intValue < 0) {
 | 
	
		
			
				|  |  | -        if(offset >= SCRIPT_STACK_SIZE) {
 | 
	
		
			
				|  |  | -            sError(sc, "load offset overflow");
 | 
	
		
			
				|  |  | +        if(offset < 0 || offset >= SCRIPT_STACK_SIZE) {
 | 
	
		
			
				|  |  | +            sError(sc, "invalid offset");
 | 
	
		
			
				|  |  |              return NULL;
 | 
	
		
			
				|  |  |          }
 | 
	
		
			
				|  |  |          Value* v = sc->stack + offset;
 | 
	
	
		
			
				|  | @@ -432,8 +431,8 @@ static Value* sLoadFromPointer(Script* sc, Value* p, ValueType wantedType) {
 | 
	
		
			
				|  |  |          sError(sc, "invalid heap pointer %d", p->data.intValue);
 | 
	
		
			
				|  |  |          return NULL;
 | 
	
		
			
				|  |  |      }
 | 
	
		
			
				|  |  | -    if((int32)offset >= a->realLength) {
 | 
	
		
			
				|  |  | -        sError(sc, "invalid heap pointer offset %u %d", offset, a->realLength);
 | 
	
		
			
				|  |  | +    if(offset >= a->realLength) {
 | 
	
		
			
				|  |  | +        sError(sc, "invalid heap pointer offset %d %d", offset, a->realLength);
 | 
	
		
			
				|  |  |          return NULL;
 | 
	
		
			
				|  |  |      }
 | 
	
		
			
				|  |  |      return a->data + offset;
 |