Detect negative name size in pk3s.

git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@12151 d7cf8633-e32d-0410-b094-e92efae38249

diff --git a/fs.c b/fs.c
index 8c8059ca59c629c07c600bb23d22d07cdde965e8..27381f07cc6bbf2a1ca40da9ab354e737d70934a 100644 (file)
--- a/fs.c
+++ b/fs.c
@@ -668,7 +668,7 @@ static int PK3_BuildFileList (pack_t *pack, const pk3_endOfCentralDir_t *eocd)
                if ((ptr[8] & 0x21) == 0 && (ptr[38] & 0x18) == 0)
                {
                        // Still enough bytes for the name?
-                       if (remaining < namesize || namesize >= (int)sizeof (*pack->files))
+                       if (namesize < 0 || remaining < namesize || namesize >= (int)sizeof (*pack->files))
                        {
                                Mem_Free (central_dir);
                                return -1;