From 65521d0c88f598836dae70761720775e63f339d0 Mon Sep 17 00:00:00 2001
From: smallmodel <15067410+smallmodel@users.noreply.github.com>
Date: Fri, 11 Oct 2024 20:29:32 +0200
Subject: [PATCH] Prevent SV_DropClient() from being called recursively if the
 client is dropped by a kick or timeout and has too many reliable commands

---
 code/server/sv_client.c | 10 ++++++++++
 code/server/sv_main.c   |  6 ++++++
 2 files changed, 16 insertions(+)

diff --git a/code/server/sv_client.c b/code/server/sv_client.c
index 1d230c07ca..78ba9c63e2 100644
--- a/code/server/sv_client.c
+++ b/code/server/sv_client.c
@@ -659,6 +659,16 @@ void SV_DropClient( client_t *drop, const char *reason ) {
 	// Free all allocated data on the client structure
 	SV_FreeClient(drop);
 
+	// Reset the reliable sequence to the currently acknowledged command
+	// This prevents SV_AddServerCommand() from making another recursive call to SV_DropClient()
+	// if the client lacks sufficient space for another reliable command
+	// it also guarantees that the client receives both the print and disconnect commands
+	drop->reliableSequence = drop->reliableAcknowledge;
+	// Setting the gamestate message number to -1 ensures that SV_AddServerCommand()
+	// will not call SV_DropClient() again, even though it is unlikely the client
+	// will receive many server commands during the drop
+	drop->gamestateMessageNum = -1;
+
 	// tell everyone why they got dropped
 	SV_SendServerCommand( NULL, "print \"%s" S_COLOR_WHITE " %s\n\"", drop->name, reason );
 
diff --git a/code/server/sv_main.c b/code/server/sv_main.c
index 4d94c1e32a..b56b13b121 100644
--- a/code/server/sv_main.c
+++ b/code/server/sv_main.c
@@ -159,6 +159,12 @@ void SV_AddServerCommand( client_t *client, const char *cmd ) {
 	// we check == instead of >= so a broadcast print added by SV_DropClient()
 	// doesn't cause a recursive drop client
 	if ( client->reliableSequence - client->reliableAcknowledge == MAX_RELIABLE_COMMANDS + 1 ) {
+		if ( client->gamestateMessageNum == -1 )  {
+			// invalid game state message 
+			// this can occur in SV_DropClient() to avoid calling it more than once
+			return;
+		}
+
 		Com_Printf( "===== pending server commands =====\n" );
 		for ( i = client->reliableAcknowledge + 1 ; i <= client->reliableSequence ; i++ ) {
 			Com_Printf( "cmd %5d: %s\n", i, client->reliableCommands[ i & (MAX_RELIABLE_COMMANDS-1) ] );