diff --git a/engine/client/cl_tent.c b/engine/client/cl_tent.c index 1e9c19e9..36ea6003 100644 --- a/engine/client/cl_tent.c +++ b/engine/client/cl_tent.c @@ -1904,7 +1904,7 @@ handle temp-entity messages void CL_ParseTempEntity( sizebuf_t *msg ) { sizebuf_t buf; - byte pbuf[256]; + byte pbuf[2048]; int iSize; int type, color, count, flags; int decalIndex, modelIndex, entityIndex; @@ -1923,6 +1923,10 @@ void CL_ParseTempEntity( sizebuf_t *msg ) decalIndex = modelIndex = entityIndex = 0; + // this will probably be fatal anyway + if( iSize > sizeof( pbuf )) + Con_Printf( S_ERROR "%s: Temp buffer overflow!\n", __FUNCTION__ ); + // parse user message into buffer MSG_ReadBytes( msg, pbuf, iSize );