+ unsigned char name[16];
+ unsigned int mipoffset[4];
+
+ MSG_BeginReading(sb);
+ MSG_ReadBytes(sb, 16, name);
+ image_width = MSG_ReadLittleLong(sb);
+ image_height = MSG_ReadLittleLong(sb);
+ mipoffset[0] = MSG_ReadLittleLong(sb);
+ mipoffset[1] = MSG_ReadLittleLong(sb); // should be mipoffset[0] + image_width*image_height
+ mipoffset[2] = MSG_ReadLittleLong(sb); // should be mipoffset[1] + image_width*image_height/4
+ mipoffset[3] = MSG_ReadLittleLong(sb); // should be mipoffset[2] + image_width*image_height/16
+ pal = sb->data + mipoffset[3] + (image_width / 8 * image_height / 8) + 2;
+
+ // bail if any data looks wrong
+ if (image_width < 0
+ || image_width > 4096
+ || image_height < 0
+ || image_height > 4096
+ || mipoffset[0] != 40
+ || mipoffset[1] != mipoffset[0] + image_width * image_height
+ || mipoffset[2] != mipoffset[1] + image_width / 2 * image_height / 2
+ || mipoffset[3] != mipoffset[2] + image_width / 4 * image_height / 4
+ || (unsigned int)sb->cursize < (mipoffset[3] + image_width / 8 * image_height / 8 + 2 + 768))
+ return NULL;