diff options
Diffstat (limited to 'src/qcommon/msg.c')
| -rw-r--r-- | src/qcommon/msg.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/qcommon/msg.c b/src/qcommon/msg.c index c85360c4..ba956bc8 100644 --- a/src/qcommon/msg.c +++ b/src/qcommon/msg.c @@ -1033,6 +1033,10 @@ void MSG_ReadDeltaEntity( msg_t *msg, entityState_t *from, entityState_t *to, numFields = sizeof(entityStateFields)/sizeof(entityStateFields[0]); lc = MSG_ReadByte(msg); + if ( lc > numFields || lc < 0 ) { + Com_Error( ERR_DROP, "invalid entityState field count" ); + } + // shownet 2/3 will interleave with other printed info, -1 will // just print the delta records` if ( cl_shownet->integer >= 2 || cl_shownet->integer == -1 ) { @@ -1352,6 +1356,10 @@ void MSG_ReadDeltaPlayerstate (msg_t *msg, playerState_t *from, playerState_t *t numFields = sizeof( playerStateFields ) / sizeof( playerStateFields[0] ); lc = MSG_ReadByte(msg); + if ( lc > numFields || lc < 0 ) { + Com_Error( ERR_DROP, "invalid playerState field count" ); + } + for ( i = 0, field = playerStateFields ; i < lc ; i++, field++ ) { fromF = (int *)( (byte *)from + field->offset ); toF = (int *)( (byte *)to + field->offset ); |