From: black <black@d7cf8633-e32d-0410-b094-e92efae38249>
Date: Mon, 23 May 2005 14:07:00 +0000 (+0000)
Subject: -Fixed a possible buffer overflow bug in NetConn_ReceivedMessage (thanks Spike!)
X-Git-Tag: xonotic-v0.1.0preview~4859
X-Git-Url: https://git.rm.cloudns.org/?a=commitdiff_plain;h=26732adaa8ff2bdf233717a8f0c6ea64023c3da8;p=xonotic%2Fdarkplaces.git

-Fixed a possible buffer overflow bug in NetConn_ReceivedMessage (thanks Spike!)


git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@5322 d7cf8633-e32d-0410-b094-e92efae38249
---

diff --git a/netconn.c b/netconn.c
index 054a5fb3..713b4678 100755
--- a/netconn.c
+++ b/netconn.c
@@ -844,8 +844,15 @@ int NetConn_ReceivedMessage(netconn_t *conn, qbyte *data, int length)
 					conn->lastMessageTime = realtime;
 					conn->timeout = realtime + net_messagetimeout.value;
 					conn->receiveSequence++;
-					memcpy(conn->receiveMessage + conn->receiveMessageLength, data, length);
-					conn->receiveMessageLength += length;
+					if( conn->receiveMessageLength + length <= sizeof( conn->receiveMessage ) ) {
+						memcpy(conn->receiveMessage + conn->receiveMessageLength, data, length);
+						conn->receiveMessageLength += length;
+					} else {
+						Con_Printf( "Reliable message (seq: %i) too big for message buffer!\n"
+									"Dropping the message!\n", sequence );
+						conn->receiveMessageLength = 0;
+						return 1;
+					} 
 					if (flags & NETFLAG_EOM)
 					{
 						reliableMessagesReceived++;