* Range-check array indices in CG_ParseTeamInfo (Roman "kevlarman" Tetelman)

 * Don't send tinfo servercommands by default

1 files changed, 11 insertions, 0 deletions

diff --git a/src/cgame/cg_servercmds.c b/src/cgame/cg_servercmds.c
index 115c4ccf..e9de4646 100644
--- a/src/cgame/cg_servercmds.c
+++ b/src/cgame/cg_servercmds.c
@@ -82,10 +82,21 @@ static void CG_ParseTeamInfo( void )
   int   client;
 
   numSortedTeamPlayers = atoi( CG_Argv( 1 ) );
+  if( numSortedTeamPlayers < 0 || numSortedTeamPlayers > TEAM_MAXOVERLAY )
+  {
+    CG_Error( "CG_ParseTeamInfo: numSortedTeamPlayers out of range (%d)",
+      numSortedTeamPlayers );
+    return;
+  }
 
   for( i = 0; i < numSortedTeamPlayers; i++ )
   {
     client = atoi( CG_Argv( i * 5 + 2 ) );
+    if( client < 0 || client >= MAX_CLIENTS )
+    {
+      CG_Error( "CG_ParseTeamInfo: bad client number: %d", client );
+      return;
+    }
 
     sortedTeamPlayers[ i ] = client;