engine: fix possible buffer overflow when looking for BSPX header

This commit is contained in:
Alibek Omarov
2026-04-05 04:58:08 +05:00
parent 983427ebb3
commit 6179bef160

View File

@@ -3793,7 +3793,7 @@ static fs_offset_t Mod_FindBSPX( const byte *mod_base, size_t bufferlen )
max_offset = ALIGN( max_offset, 4 ); // force 32-bit boundary
if( max_offset > bufferlen )
if( max_offset + sizeof( dbspx_hdr_t ) > bufferlen )
return -1;
bspx_header = (const dbspx_hdr_t *)( mod_base + max_offset );