The engine allows you to access outside the malloc'ed area because it doesnt check youve stayed inside.
Real C, C++ and even C# dont check for this either. Thats up to you...
One point to remember though, when using "sizeof" in 3dgs, always precede it with (int) if you are multiplying it.
BMAP* BmapList = (BMAP*)malloc((int)sizeof(BMAP)*15);
Otherwise the size is not calculated correctly.
