fix overflow in CG_ParseTeamInfo

based on patch for Tremulous, thanks to Roman Tetelman
ioquake · Jan 13, 2009 · cde5fcf · cde5fcf
1 parent a1f9885
commit cde5fcf
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/code/cgame/cg_servercmds.c b/code/cgame/cg_servercmds.c
@@ -118,9 +118,20 @@ static void CG_ParseTeamInfo( void ) {
 	int		client;
 
 	numSortedTeamPlayers = atoi( CG_Argv( 1 ) );
+	if( numSortedTeamPlayers < 0 || numSortedTeamPlayers > TEAM_MAXOVERLAY )
+	{
+		CG_Error( "CG_ParseTeamInfo: numSortedTeamPlayers out of range (%d)",
+				numSortedTeamPlayers );
+		return;
+	}
 
 	for ( i = 0 ; i < numSortedTeamPlayers ; i++ ) {
 		client = atoi( CG_Argv( i * 6 + 2 ) );
+		if( client < 0 || client >= MAX_CLIENTS )
+		{
+		  CG_Error( "CG_ParseTeamInfo: bad client number: %d", client );
+		  return;
+		}
 
 		sortedTeamPlayers[i] = client;