From be35b3503e0ff7fd72489f67ad8a63e5edfb07bb Mon Sep 17 00:00:00 2001
From: Alibek Omarov <a1ba.omarov@gmail.com>
Date: Sun, 17 May 2026 10:54:51 +0500
Subject: [PATCH] engine: limit maximum amount of pending fragbufs

---
 engine/common/net_chan.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/engine/common/net_chan.c b/engine/common/net_chan.c
index 599cce5c..84028035 100644
--- a/engine/common/net_chan.c
+++ b/engine/common/net_chan.c
@@ -28,6 +28,8 @@ GNU General Public License for more details.
 
 #define UDP_HEADER_SIZE		28
 
+#define MAX_NETCHAN_FRAGBUFS_PER_STREAM	8192
+
 #define FLOW_AVG			( 2.0f / 3.0f )	// how fast to converge flow estimates
 #define FLOW_INTERVAL		0.1		// don't compute more often than this
 #define MAX_RELIABLE_PAYLOAD		1400		// biggest packet that has frag and or reliable data
@@ -750,18 +752,26 @@ static fragbuf_t *Netchan_FindBufferById( fragbuf_t **pplist, int id, qboolean a
 {
 	fragbuf_t	*list = *pplist;
 	fragbuf_t	*pnewbuf;
+	int		count = 0;
 
 	while( list )
 	{
 		if( list->bufferid == id )
 			return list;
 
+		count++;
 		list = list->next;
 	}
 
 	if( !allocate )
 		return NULL;
 
+	if( count >= MAX_NETCHAN_FRAGBUFS_PER_STREAM )
+	{
+		Con_DPrintf( S_ERROR "%s: too many pending fragments (%d), dropping new fragid %d\n", __func__, count, id );
+		return NULL;
+	}
+
 	// create new entry
 	pnewbuf = Netchan_AllocFragbuf( NET_MAX_FRAGMENT );
 	pnewbuf->bufferid = id;