@@ -735,8 +735,21 @@ internal void AddReliablePacket(DeliveryMethod method, NetPacket p)
735735 for ( int i = 0 ; i < incomingFragments . ReceivedCount ; i ++ )
736736 {
737737 var fragment = fragments [ i ] ;
738-
739738 int writtenSize = fragment . Size - NetConstants . FragmentedHeaderTotalSize ;
739+
740+ if ( pos + writtenSize > resultingPacket . RawData . Length )
741+ {
742+ _holdedFragments . Remove ( packetFragId ) ;
743+ NetDebug . WriteError ( "Fragment error pos: {0} >= resultPacketSize: {1}" , pos + writtenSize , resultingPacket . RawData . Length ) ;
744+ return ;
745+ }
746+ if ( fragment . Size > fragment . RawData . Length )
747+ {
748+ _holdedFragments . Remove ( packetFragId ) ;
749+ NetDebug . WriteError ( "Fragment error size: {0} > fragment.RawData.Length: {1}" , fragment . Size , fragment . RawData . Length ) ;
750+ return ;
751+ }
752+
740753 //Create resulting big packet
741754 Buffer . BlockCopy (
742755 fragment . RawData ,
@@ -748,14 +761,14 @@ internal void AddReliablePacket(DeliveryMethod method, NetPacket p)
748761
749762 //Free memory
750763 _packetPool . Recycle ( fragment ) ;
764+ fragments [ i ] = null ;
751765 }
752- Array . Clear ( fragments , 0 , incomingFragments . ReceivedCount ) ;
753-
754- //Send to process
755- NetManager . CreateReceiveEvent ( resultingPacket , method , 0 , this ) ;
756766
757767 //Clear memory
758768 _holdedFragments . Remove ( packetFragId ) ;
769+
770+ //Send to process
771+ NetManager . CreateReceiveEvent ( resultingPacket , method , 0 , this ) ;
759772 }
760773 else //Just simple packet
761774 {
0 commit comments