From f5b2c4f7afa689ce2dacc83be8c22cb18e153192 Mon Sep 17 00:00:00 2001 From: Alibek Omarov Date: Tue, 13 Jan 2026 05:43:09 +0500 Subject: [PATCH] engine: client: prevent a crash in goldsrc delta entities parser --- engine/client/cl_parse_gs.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/engine/client/cl_parse_gs.c b/engine/client/cl_parse_gs.c index 1fbf63e5..60bc294d 100644 --- a/engine/client/cl_parse_gs.c +++ b/engine/client/cl_parse_gs.c @@ -206,6 +206,7 @@ static void CL_DeltaEntityGS( const delta_header_t *hdr, sizebuf_t *msg, frame_t qboolean newent = from == NULL; int pack = frame->num_entities; qboolean has_update = msg != NULL; + static entity_state_t nullent; // alloc next slot to store update to = &cls.packet_entities[cls.next_client_entities % cls.num_client_entities]; @@ -233,7 +234,17 @@ static void CL_DeltaEntityGS( const delta_header_t *hdr, sizebuf_t *msg, frame_t if( hdr->instanced ) from = &cl.instanced_baseline[hdr->instanced_baseline_index]; else if( hdr->offset != 0 ) - from = &cls.packet_entities[(cls.next_client_entities - hdr->offset) % cls.num_client_entities]; + { + // FIXME: the usage of `offset` is incorrect here as the entities might + // not be ordered in cls.packet_entities the same way as on server + // catch the error, print the scary message and fix it up to nullent + if( cls.next_client_entities - hdr->offset < 0 ) + { + Con_Printf( S_ERROR "%s: prevented delta-ing from invalid entity (%d - %d < 0)\n", __func__, cls.next_client_entities, hdr->offset ); + from = &nullent; + } + else from = &cls.packet_entities[(cls.next_client_entities - hdr->offset ) % cls.num_client_entities]; + } else from = &ent->baseline; }