(svn r14897) -Codechange: don't allow a few command flags to be sent over the network as it's bogus information anyway; e.g. the "do not send over network" flag as it will be set whenever the command is received from the server/client.

-Codechange: test earlier whether the command (send from the server) is actually valid.

1 files changed, 18 insertions, 0 deletions

diff --git a/src/network/network_client.cpp b/src/network/network_client.cpp
index 2d7256beb..1c56fda7c 100644
--- a/src/network/network_client.cpp
+++ b/src/network/network_client.cpp
@@ -685,6 +685,24 @@ DEF_CLIENT_RECEIVE_COMMAND(PACKET_SERVER_COMMAND)
 	cp->my_cmd   = p->Recv_bool();
 	cp->next     = NULL;
 
+	if (!IsValidCommand(cp->cmd)) {
+		IConsolePrintF(CC_ERROR, "WARNING: invalid command from server, dropping...");
+		free(cp);
+		return NETWORK_RECV_STATUS_MALFORMED_PACKET;
+	}
+
+	if (GetCommandFlags(cp->cmd) & CMD_OFFLINE) {
+		IConsolePrintF(CC_ERROR, "WARNING: offline only command from server, dropping...");
+		free(cp);
+		return NETWORK_RECV_STATUS_MALFORMED_PACKET;
+	}
+
+	if ((cp->cmd & CMD_FLAGS_MASK) != 0) {
+		IConsolePrintF(CC_ERROR, "WARNING: invalid command flag from server, dropping...");
+		free(cp);
+		return NETWORK_RECV_STATUS_MALFORMED_PACKET;
+	}
+
 	// The server did send us this command..
 	//  queue it in our own queue, so we can handle it in the upcoming frame!