From 8039dff51fe095283dfff7c2f4316c0a8b43f2f0 Mon Sep 17 00:00:00 2001
From: Kelsi <kelsihates2fa@gmail.com>
Date: Wed, 6 May 2026 09:54:25 -0700
Subject: [PATCH] fix(npc): cap patrol path length at 256 waypoints on load

A stale autosave or hand-edited creature.json could carry an
unbounded patrolPath. The SQL exporter would emit one waypoint_data
INSERT per entry and produce huge SQL files. 256 waypoints covers
any realistic route.
---
 tools/editor/npc_spawner.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/editor/npc_spawner.cpp b/tools/editor/npc_spawner.cpp
index 03ef2d2a..7b314d6a 100644
--- a/tools/editor/npc_spawner.cpp
+++ b/tools/editor/npc_spawner.cpp
@@ -224,7 +224,12 @@ bool NpcSpawner::loadFromFile(const std::string& path) {
             }
 
             if (js.contains("patrol") && js["patrol"].is_array()) {
+                // Cap patrol size at 256 waypoints — covers any realistic
+                // route and keeps SQL export size bounded for malformed
+                // input (a stale autosave that grew unbounded).
+                constexpr size_t kMaxPatrolPoints = 256;
                 for (const auto& pt : js["patrol"]) {
+                    if (s.patrolPath.size() >= kMaxPatrolPoints) break;
                     if (pt.is_array() && pt.size() >= 4) {
                         PatrolPoint pp;
                         pp.position = glm::vec3(pt[0].get<float>(), pt[1].get<float>(), pt[2].get<float>());