From f9ab09356ef861a706f85fc8819da73dfe097a03 Mon Sep 17 00:00:00 2001
From: Adam Olsen <rhamph@gmail.com>
Date: Fri, 2 Nov 2001 06:39:51 +0000
Subject: [PATCH] - make nails, soundlist, and modellist return NET_ERROR when
 there's   too many items in the block

---
 qw/source/net_svc.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/qw/source/net_svc.c b/qw/source/net_svc.c
index 97ce4f46e..e1d60d7fd 100644
--- a/qw/source/net_svc.c
+++ b/qw/source/net_svc.c
@@ -345,7 +345,7 @@ NET_SVC_Nails_Parse (net_svc_nails_t *block, msg_t *msg)
 			bits[j] = MSG_ReadByte (msg);
 
 		if (i >= MAX_PROJECTILES)
-			continue;
+			return NET_ERROR;
 
 		// [48 bits] xyzpy 12 12 12 4 8
 		// format is 12 bits per origin coord, 4 for angles[0],
@@ -358,9 +358,6 @@ NET_SVC_Nails_Parse (net_svc_nails_t *block, msg_t *msg)
 		block->nails[i].angles[2] = 0;
 	}
 
-	if (block->numnails > MAX_PROJECTILES)
-		block->numnails = MAX_PROJECTILES;
-
 	return msg->badread;
 }
 
@@ -371,10 +368,12 @@ NET_SVC_Modellist_Parse (net_svc_modellist_t *block, msg_t *msg)
 
 	block->startmodel = MSG_ReadByte (msg);
 
-	for (i = 0; i < MAX_MODELS; i++) {
+	for (i = 0;; i++) {
 		block->models[i] = MSG_ReadString (msg);
 		if (!*block->models[i])
 			break;
+		if (i >= MAX_MODELS)
+			return NET_ERROR;
 	}
 	// this is a bit redundant, but I think the robustness is a good thing
 	block->models[MAX_MODELS] = "";
@@ -391,10 +390,12 @@ NET_SVC_Soundlist_Parse (net_svc_soundlist_t *block, msg_t *msg)
 
 	block->startsound = MSG_ReadByte (msg);
 
-	for (i = 0; i < MAX_MODELS; i++) {
+	for (i = 0;; i++) {
 		block->sounds[i] = MSG_ReadString (msg);
 		if (!*block->sounds[i])
 			break;
+		if (i >= MAX_SOUNDS)
+			return NET_ERROR;
 	}
 	// this is a bit redundant, but I think the robustness is a good thing
 	block->sounds[MAX_SOUNDS] = "";