From e324fe3e26138a6310b111b691fe3c1d61b378e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EB=82=B4=20=EC=9D=B4=EB=A6=84?= <you@example.com>
Date: Mon, 12 Apr 2021 20:33:02 +0900
Subject: [PATCH 1/3] SV_POINTS oob

---
 source/src/clients2c.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/source/src/clients2c.cpp b/source/src/clients2c.cpp
index 152169ce..27da8681 100644
--- a/source/src/clients2c.cpp
+++ b/source/src/clients2c.cpp
@@ -814,6 +814,9 @@ void parsemessages(int cn, playerent *d, ucharbuf &p, bool demo = false)
 //                         medals_arrived=1;
                         loopi(medals) {
                             int mcn=getint(p); int mtype=getint(p); int mitem=getint(p);
+                            if(mtype >= END_MDS || mtype<0){
+                                break;
+                            }
                             a_medals[mtype].assigned=1;
                             a_medals[mtype].cn=mcn;
                             a_medals[mtype].item=mitem;

From ac5152815f055de2ef76a261f0dc2082030f755c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EB=82=B4=20=EC=9D=B4=EB=A6=84?= <you@example.com>
Date: Mon, 12 Apr 2021 20:35:01 +0900
Subject: [PATCH 2/3] SV_DAMAGE OOB

---
 source/src/clients2c.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source/src/clients2c.cpp b/source/src/clients2c.cpp
index 27da8681..d490169d 100644
--- a/source/src/clients2c.cpp
+++ b/source/src/clients2c.cpp
@@ -790,7 +790,7 @@ void parsemessages(int cn, playerent *d, ucharbuf &p, bool demo = false)
                     armour = getint(p),
                     health = getint(p);
                 playerent *target = getclient(tcn), *actor = getclient(acn);
-                if(!target || !actor) break;
+                if(!target || !actor || valid_weapon(gun)) break;
                 target->armour = armour;
                 target->health = health;
                 dodamage(damage, target, actor, -1, type==SV_GIBDAMAGE, false);

From d19ee07d3c89707784440fa65bb57165f6d30df9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EB=82=B4=20=EC=9D=B4=EB=A6=84?= <you@example.com>
Date: Mon, 12 Apr 2021 20:36:17 +0900
Subject: [PATCH 3/3] SV_RELOAD OOB

---
 source/src/clients2c.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/source/src/clients2c.cpp b/source/src/clients2c.cpp
index d490169d..4434cc73 100644
--- a/source/src/clients2c.cpp
+++ b/source/src/clients2c.cpp
@@ -747,6 +747,10 @@ void parsemessages(int cn, playerent *d, ucharbuf &p, bool demo = false)
             case SV_RELOAD:
             {
                 int cn = getint(p), gun = getint(p);
+                if(!valid_weapon(gun)){
+                    break;
+                }
+
                 playerent *p = getclient(cn);
                 if(p && p!=player1) p->weapons[gun]->reload(false);
                 break;