-Fixed a possible buffer overflow bug in NetConn_ReceivedMessage (thanks Spike!)

git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@5322 d7cf8633-e32d-0410-b094-e92efae38249

diff --git a/netconn.c b/netconn.c
index 054a5fb3805180bfe29e713b783f58558e6cdd46..713b46780be9409afb4285ee19f67edfbca3528b 100755 (executable)
--- a/netconn.c
+++ b/netconn.c
@@ -844,8 +844,15 @@ int NetConn_ReceivedMessage(netconn_t *conn, qbyte *data, int length)
                                        conn->lastMessageTime = realtime;
                                        conn->timeout = realtime + net_messagetimeout.value;
                                        conn->receiveSequence++;
-                                       memcpy(conn->receiveMessage + conn->receiveMessageLength, data, length);
-                                       conn->receiveMessageLength += length;
+                                       if( conn->receiveMessageLength + length <= sizeof( conn->receiveMessage ) ) {
+                                               memcpy(conn->receiveMessage + conn->receiveMessageLength, data, length);
+                                               conn->receiveMessageLength += length;
+                                       } else {
+                                               Con_Printf( "Reliable message (seq: %i) too big for message buffer!\n"
+                                                                       "Dropping the message!\n", sequence );
+                                               conn->receiveMessageLength = 0;
+                                               return 1;
+                                       } 
                                        if (flags & NETFLAG_EOM)
                                        {
                                                reliableMessagesReceived++;