move->cursor_impact[0] = MSG_ReadFloat();
move->cursor_impact[1] = MSG_ReadFloat();
move->cursor_impact[2] = MSG_ReadFloat();
- move->cursor_entitynumber = MSG_ReadShort();
+ move->cursor_entitynumber = (unsigned short)MSG_ReadShort();
+ if (move->cursor_entitynumber >= sv.max_edicts)
+ {
+ Con_DPrintf("SV_ReadClientMessage: client send bad cursor_entitynumber\n");
+ move->cursor_entitynumber = 0;
+ }
// as requested by FrikaC, cursor_trace_ent is reset to world if the
// entity is free at time of receipt
if (EDICT_NUM(move->cursor_entitynumber)->e->free)
|| strncasecmp(s, "pmodel", 6) == 0
|| strncasecmp(s, "rate", 4) == 0
|| strncasecmp(s, "playermodel", 11) == 0
- || strncasecmp(s, "playerskin", 10) == 00
+ || strncasecmp(s, "playerskin", 10) == 0
|| (gamemode == GAME_NEHAHRA && (strncasecmp(s, "max", 3) == 0 || strncasecmp(s, "monster", 7) == 0 || strncasecmp(s, "scrag", 5) == 0 || strncasecmp(s, "gimme", 5) == 0 || strncasecmp(s, "wraith", 6) == 0))
|| (gamemode != GAME_NEHAHRA && (strncasecmp(s, "god", 3) == 0 || strncasecmp(s, "notarget", 8) == 0 || strncasecmp(s, "fly", 3) == 0 || strncasecmp(s, "give", 4) == 0 || strncasecmp(s, "noclip", 6) == 0)))
Cmd_ExecuteString (s, src_client);