From 33cd20b21b191e2b8a96161a3ba026669fd371b8 Mon Sep 17 00:00:00 2001
From: Czarintax <38297231+Czarintax@users.noreply.github.com>
Date: Mon, 25 May 2026 10:42:03 +0200
Subject: [PATCH] engine: server: fix SV_ProcessFile crash from short malformed
 filename (#2606)

---
 engine/server/sv_main.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/engine/server/sv_main.c b/engine/server/sv_main.c
index 98d4ddea..cb556b0a 100644
--- a/engine/server/sv_main.c
+++ b/engine/server/sv_main.c
@@ -312,6 +312,12 @@ static void SV_ProcessFile( sv_client_t *cl, const char *filename )
 		return;
 	}
 
+	if( Q_strlen( filename ) < 36 )
+	{
+		Con_Printf( "%s: Malformed customization filename from %s (too short)\n", __func__, cl->name );
+		return;
+	}
+
 	COM_HexConvert( filename + 4, 32, md5 );
 
 	for( resource = cl->resourcesneeded.pNext; resource != &cl->resourcesneeded; resource = next )