From 86986446a5d5bef67741accc5645fb90919931c5 Mon Sep 17 00:00:00 2001
From: Randy Heit <rheit@users.noreply.github.com>
Date: Thu, 1 Jan 2015 17:57:09 -0600
Subject: [PATCH] Fixed: TicSpecial could run out of space when writing data

- Fixed: TicSpecial::CheckSpace() never thought it ran out of space due to
  unsigned math.
- Fixed: TicSpecial::GetMoreSpace() assumed only relatively small amounts
  of data would be written at a time so made no effort to ensure it
  actually got enough space. This assumption could be violated by writing
  a very long string, which can happen when replicating a string cvar.
---
 src/d_net.cpp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/d_net.cpp b/src/d_net.cpp
index ff70fdbf9d..b3e70d410f 100644
--- a/src/d_net.cpp
+++ b/src/d_net.cpp
@@ -185,7 +185,7 @@ static struct TicSpecial
 	size_t used[BACKUPTICS];
 	BYTE *streamptr;
 	size_t streamoffs;
-	int   specialsize;
+	size_t specialsize;
 	int	  lastmaketic;
 	bool  okay;
 
@@ -224,11 +224,11 @@ static struct TicSpecial
 	}
 
 	// Make more room for special commands.
-	void GetMoreSpace ()
+	void GetMoreSpace (size_t needed)
 	{
 		int i;
 
-		specialsize <<= 1;
+		specialsize = MAX(specialsize * 2, needed + 30);
 
 		DPrintf ("Expanding special size to %d\n", specialsize);
 
@@ -240,8 +240,8 @@ static struct TicSpecial
 
 	void CheckSpace (size_t needed)
 	{
-		if (streamoffs >= specialsize - needed)
-			GetMoreSpace ();
+		if (streamoffs + needed >= specialsize)
+			GetMoreSpace (streamoffs + needed);
 
 		streamoffs += needed;
 	}