FWGS
/
xash3d-fwgs
mirror of https://github.com/FWGS/xash3d-fwgs
2
0
Fork 0
Code Issues 2 Projects Releases Wiki Activity

engine: server: fix possible array overruns

This commit is contained in:
Alibek Omarov 2022-05-25 17:57:47 +03:00
parent 52d1383f14
commit 33d79ddb24
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
engine/server/sv_custom.c
View File

@ -533,7 +533,7 @@ void SV_BatchUploadRequest( sv_client_t *cl )
void SV_SendResource( resource_t *pResource, sizebuf_t *msg ) void SV_SendResource( resource_t *pResource, sizebuf_t *msg )
{ {
static byte nullrguc[36]; static byte nullrguc[sizeof( pResource->rguc_reserved )];
MSG_WriteUBitLong( msg, pResource->type, 4 ); MSG_WriteUBitLong( msg, pResource->type, 4 );
MSG_WriteString( msg, pResource->szFileName ); MSG_WriteString( msg, pResource->szFileName );

6
engine/server/sv_game.c
View File

@ -108,7 +108,7 @@ entavrs table for FindEntityByString
*/ */
TYPEDESCRIPTION *SV_GetEntvarsDescirption( int number ) TYPEDESCRIPTION *SV_GetEntvarsDescirption( int number )
{ {
if( number < 0 && number >= ENTVARS_COUNT ) if( number < 0 || number >= ENTVARS_COUNT )
return NULL; return NULL;
return &gEntvarsDescription[number]; return &gEntvarsDescription[number];
} }
@ -3984,7 +3984,7 @@ void GAME_EXPORT SV_PlaybackEventFull( int flags, const edict_t *pInvoker, word
return; // someone stupid joke return; // someone stupid joke
// first check event for out of bounds // first check event for out of bounds
if( eventindex < 1 || eventindex > MAX_EVENTS ) if( eventindex < 1 || eventindex >= MAX_EVENTS )
{ {
Con_Printf( S_ERROR "EV_Playback: invalid eventindex %i\n", eventindex ); Con_Printf( S_ERROR "EV_Playback: invalid eventindex %i\n", eventindex );
return; return;
@ -4914,7 +4914,7 @@ qboolean SV_ParseEdict( char **pfile, edict_t *ent )
Mem_Free( pkvd[i].szValue ); Mem_Free( pkvd[i].szValue );
} }
if( classname && Mem_IsAllocatedExt( host.mempool, classname )) if( Mem_IsAllocatedExt( host.mempool, classname ))
Mem_Free( classname ); Mem_Free( classname );
return true; return true;