From 6179bef160ad81efe4d89c6e74b6cb04c9d6358c Mon Sep 17 00:00:00 2001 From: Alibek Omarov Date: Sun, 5 Apr 2026 04:58:08 +0500 Subject: [PATCH] engine: fix possible buffer overflow when looking for BSPX header --- engine/common/mod_bmodel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/engine/common/mod_bmodel.c b/engine/common/mod_bmodel.c index d0564535..6e31fcb6 100644 --- a/engine/common/mod_bmodel.c +++ b/engine/common/mod_bmodel.c @@ -3793,7 +3793,7 @@ static fs_offset_t Mod_FindBSPX( const byte *mod_base, size_t bufferlen ) max_offset = ALIGN( max_offset, 4 ); // force 32-bit boundary - if( max_offset > bufferlen ) + if( max_offset + sizeof( dbspx_hdr_t ) > bufferlen ) return -1; bspx_header = (const dbspx_hdr_t *)( mod_base + max_offset );