Fixed: Remote vulnerability in Cl_ReadSoundDelta2 due to malformed pa…

…ckets. Thanks yagisan.
skyjake · May 26, 2009 · f44bcaf · f44bcaf
1 parent 098ccdc
commit f44bcaf
Showing 1 changed file with 15 additions and 1 deletion.
diff --git a/doomsday/engine/portable/src/cl_sound.c b/doomsday/engine/portable/src/cl_sound.c
@@ -93,7 +93,15 @@ void Cl_ReadSoundDelta2(deltatype_t type, boolean skip)
         uint                index = (ushort) Msg_ReadShort();
 
         if(index < numSectors)
-            sector = SECTOR_PTR(index);
+        {
+        	sector = SECTOR_PTR(index);
+		}
+		else
+        {
+            Con_Message("Cl_ReadSoundDelta2: DT_SECTOR_SOUND contains "
+                        "invalid sector num %u. Skipping.\n", index);
+			skip = true;
+	    }
     }
     else                        /* DT_POLY_SOUND */
     {
@@ -104,6 +112,12 @@ void Cl_ReadSoundDelta2(deltatype_t type, boolean skip)
             poly = polyObjs[index];
             emitter = (mobj_t *) poly;
         }
+        else
+        {
+            Con_Message("Cl_ReadSoundDelta2: DT_POLY_SOUND contains "
+                        "invalid polyobj num %u. Skipping.\n", index);
+			skip = true;
+		}
     }
 
     flags = Msg_ReadByte();