diff --git a/engine/gl/gl_model.c b/engine/gl/gl_model.c
index 1e574143f..d9c64383a 100644
--- a/engine/gl/gl_model.c
+++ b/engine/gl/gl_model.c
@@ -2611,23 +2611,18 @@ qboolean GLMod_LoadBrushModel (model_t *mod, void *buffer)
 	for (i=0 ; i<sizeof(dheader_t)/4 ; i++)
 		((int *)header)[i] = LittleLong ( ((int *)header)[i]);
 
-	if (1)//mod_ebfs.value)
-	{
-		char *id;
-		id = (char *)(header + 1);
-		if (id[0]=='P' && id[1]=='A' && id[2]=='C' && id[3]=='K')
-		{	//EBFS detected.
-			COM_LoadMapPackFile(mod->name, sizeof(dheader_t));
-		}
-	}
-
-
 
 // checksum all of the map, except for entities
 	mod->checksum = 0;
 	mod->checksum2 = 0;
 
-	for (i = 0; i < HEADER_LUMPS; i++) {
+	for (i = 0; i < HEADER_LUMPS; i++)
+	{
+		if ((unsigned)header->lumps[i].fileofs + (unsigned)header->lumps[i].filelen > com_filesize)
+		{
+			Con_Printf (S_ERROR "Mod_LoadBrushModel: %s appears truncated\n", mod->name);
+			return false;
+		}
 		if (i == LUMP_ENTITIES)
 			continue;
 		chksum = Com_BlockChecksum(mod_base + header->lumps[i].fileofs, header->lumps[i].filelen);
@@ -2637,6 +2632,16 @@ qboolean GLMod_LoadBrushModel (model_t *mod, void *buffer)
 			continue;
 		mod->checksum2 ^= chksum;
 	}
+
+	if (1)//mod_ebfs.value)
+	{
+		char *id;
+		id = (char *)(header + 1);
+		if (id[0]=='P' && id[1]=='A' && id[2]=='C' && id[3]=='K')
+		{	//EBFS detected.
+			COM_LoadMapPackFile(mod->name, sizeof(dheader_t));
+		}
+	}
 		
 	noerrors = true;
 
diff --git a/engine/server/svmodel.c b/engine/server/svmodel.c
index 6adf4a948..81072384f 100644
--- a/engine/server/svmodel.c
+++ b/engine/server/svmodel.c
@@ -1512,6 +1512,12 @@ qboolean Mod_LoadBrushModel (model_t *mod, void *buffer)
 	// checksum all of the map, except for entities
 	for (i = 0; i < HEADER_LUMPS; i++)
 	{
+		if ((unsigned)header->lumps[i].fileofs + (unsigned)header->lumps[i].filelen > com_filesize)
+		{
+			Con_Printf (S_ERROR "Mod_LoadBrushModel: %s appears truncated\n", mod->name);
+			return false;
+		}
+
 		if (i == LUMP_ENTITIES)
 			continue;
 		chksum = Com_BlockChecksum(mod_base + header->lumps[i].fileofs,
diff --git a/engine/sw/sw_model.c b/engine/sw/sw_model.c
index d913cf907..0cae034fb 100644
--- a/engine/sw/sw_model.c
+++ b/engine/sw/sw_model.c
@@ -2015,7 +2015,13 @@ qboolean SWMod_LoadBrushModel (model_t *mod, void *buffer)
 	mod->checksum2 = 0;
 
 // checksum all of the map, except for entities
-	for (i = 0; i < HEADER_LUMPS; i++) {
+	for (i = 0; i < HEADER_LUMPS; i++)
+	{
+		if ((unsigned)header->lumps[i].fileofs + (unsigned)header->lumps[i].filelen > com_filesize)
+		{
+			Con_Printf (S_ERROR "Mod_LoadBrushModel: %s appears truncated\n", mod->name);
+			return false;
+		}
 		if (i == LUMP_ENTITIES)
 			continue;
 		mod->checksum ^= Com_BlockChecksum(mod_base + header->lumps[i].fileofs,