Reject pk3s with obviously broken central directory.

git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@12149 d7cf8633-e32d-0410-b094-e92efae38249

diff --git a/fs.c b/fs.c
index 67d65713f498da5fb495fd50cbc74e17004dfe18..83a00d87b5807e167ff4632acf3f05d4e60292b3 100644 (file)
--- a/fs.c
+++ b/fs.c
@@ -586,6 +586,16 @@ static qboolean PK3_GetEndOfCentralDir (const char *packfile, int packhandle, pk
 
        Mem_Free (buffer);
 
+       if (
+                       eocd->cdir_size < 0 || eocd->cdir_size > filesize ||
+                       eocd->cdir_offset < 0 || eocd->cdir_offset >= filesize ||
+                       eocd->cdir_offset + eocd->cdir_size > filesize
+          )
+       {
+               // Obviously invalid central directory.
+               return false;
+       }
+
        return true;
 }