diff --git a/engine/gl/gl_model.c b/engine/gl/gl_model.c index 0fdca6c67..d31488d3e 100644 --- a/engine/gl/gl_model.c +++ b/engine/gl/gl_model.c @@ -3737,6 +3737,12 @@ TRACE(("dbg: Mod_LoadTextures: inittexturedescs\n")); m->nummiptex = LittleLong (m->nummiptex); + if ((1+m->nummiptex)*sizeof(int) > l->filelen) + { + Con_Printf(CON_WARNING "warning: %s contains corrupt texture lump\n", loadmodel->name); + return false; + } + loadmodel->numtextures = m->nummiptex; loadmodel->textures = ZG_Malloc(&loadmodel->memgroup, m->nummiptex * sizeof(*loadmodel->textures)); sizes = alloca(sizeof(*sizes)*m->nummiptex);