fix overflow in CG_ParseTeamInfo

based on patch for Tremulous, thanks to Roman Tetelman

git-svn-id: svn://svn.icculus.org/quake3/trunk@1492 edf5b092-35ff-0310-97b2-ce42778d08ea

1 files changed, 11 insertions, 0 deletions

diff --git a/code/cgame/cg_servercmds.c b/code/cgame/cg_servercmds.c
index 185a068..7761646 100644
--- a/code/cgame/cg_servercmds.c
+++ b/code/cgame/cg_servercmds.c
@@ -118,9 +118,20 @@ static void CG_ParseTeamInfo( void ) {
 	int		client;
 
 	numSortedTeamPlayers = atoi( CG_Argv( 1 ) );
+	if( numSortedTeamPlayers < 0 || numSortedTeamPlayers > TEAM_MAXOVERLAY )
+	{
+		CG_Error( "CG_ParseTeamInfo: numSortedTeamPlayers out of range (%d)",
+				numSortedTeamPlayers );
+		return;
+	}
 
 	for ( i = 0 ; i < numSortedTeamPlayers ; i++ ) {
 		client = atoi( CG_Argv( i * 6 + 2 ) );
+		if( client < 0 || client >= MAX_CLIENTS )
+		{
+		  CG_Error( "CG_ParseTeamInfo: bad client number: %d", client );
+		  return;
+		}
 
 		sortedTeamPlayers[i] = client;