From 2a662255fac841f145dbdddad1f95a5136f8d950 Mon Sep 17 00:00:00 2001 From: havoc Date: Fri, 3 Dec 2004 05:03:12 +0000 Subject: [PATCH] don't let clients kill server with bogus cursor_entitynumber values git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@4821 d7cf8633-e32d-0410-b094-e92efae38249 --- sv_user.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/sv_user.c b/sv_user.c index 63c54c69..b870bf59 100644 --- a/sv_user.c +++ b/sv_user.c @@ -688,7 +688,12 @@ void SV_ReadClientMove (usercmd_t *move) move->cursor_impact[0] = MSG_ReadFloat(); move->cursor_impact[1] = MSG_ReadFloat(); move->cursor_impact[2] = MSG_ReadFloat(); - move->cursor_entitynumber = MSG_ReadShort(); + move->cursor_entitynumber = (unsigned short)MSG_ReadShort(); + if (move->cursor_entitynumber >= sv.max_edicts) + { + Con_DPrintf("SV_ReadClientMessage: client send bad cursor_entitynumber\n"); + move->cursor_entitynumber = 0; + } // as requested by FrikaC, cursor_trace_ent is reset to world if the // entity is free at time of receipt if (EDICT_NUM(move->cursor_entitynumber)->e->free) -- 2.39.2