3 files changed, 15 insertions, 11 deletions

diff --git a/src/core/netclient.cc b/src/core/netclient.cc
index 5254b23..310a64c 100644
--- a/src/core/netclient.cc
+++ b/src/core/netclient.cc
@@ -130,10 +130,10 @@ void NetClient::transmit(int serverfd)
 		return;
 	}
 
-	char		zbuf[BLOCKSIZE];
+	unsigned char	zbuf[BLOCKSIZE];
 	const char	*data = 0;
-	unsigned long	compressed_size = BLOCKSIZE - 5;
-	unsigned long 	uncompressed_size = sendq.size();
+	uLong		compressed_size = (uLong) BLOCKSIZE - 5;
+	uLong 		uncompressed_size = (uLong) sendq.size();
 	size_t		total_size = 0;
 
 	memset(zbuf,0, sizeof(zbuf));
@@ -145,8 +145,8 @@ void NetClient::transmit(int serverfd)
 
 	if ((status == Z_OK) && (compressed_size + 4 < sendq.size())) {
 		// add a header to the compress packet
-		data = zbuf;
-		total_size = compressed_size + 4;
+		data = (char *) zbuf;
+		total_size = (size_t) (compressed_size + 4);
 		zbuf[0] = '\xff';
 		zbuf[1] = '\xff';
 		zbuf[2] = compressed_size % 256;
diff --git a/src/core/netconnection.cc b/src/core/netconnection.cc
index a0a0497..fc2e5d0 100644
--- a/src/core/netconnection.cc
+++ b/src/core/netconnection.cc
@@ -164,13 +164,13 @@ void NetConnection::receive()
 			zrecvbuf[received_compressed_size] = *c;
 			received_compressed_size++;
 
-			if (received_compressed_size == (size_t) compressed_size) {
+			if (compressed_size == received_compressed_size) {
 				// uncompress
-				char zunbuf[BLOCKSIZE];
+				char zunbuf[BLOCKSIZE*2];
 				memset(zunbuf, 0, sizeof(zunbuf));
-				unsigned long zunbuf_size = BLOCKSIZE - 1;
+				uLong zunbuf_size = (uLong) BLOCKSIZE*2 - 1;
 
-				int status = uncompress((Bytef *) zunbuf, &zunbuf_size, (Bytef *) zrecvbuf, compressed_size);
+				int status = uncompress((Bytef *) zunbuf, &zunbuf_size, (Bytef *) zrecvbuf, (uLong) compressed_size);
 
 				if (status != Z_OK) {
 					con_warn << "zlib error " << status << " uncompressing incoming datablock!\n";
@@ -203,10 +203,14 @@ void NetConnection::receive()
 
 				receive_compressed = true;
 				received_compressed_size = 0;
-				compressed_size = *(c+2) + (*(c+3) << 8);
+				compressed_size = (uLong) (*(unsigned char *)(c+2) + (*(unsigned char *)(c+3) << 8));
 				c += 3;
 				bytes_received -= 3;
 				memset(zrecvbuf, 0, sizeof(zrecvbuf));
+				if (compressed_size > BLOCKSIZE) {
+					con_warn << "Incoming compressed datablock exceeds " << BLOCKSIZE << " bytes!\n";
+					receive_compressed = false;
+				}
 
 		} else if  (( *c == '\n') || (*c == '\r')) { 
 			if (messageblock.size()) {
diff --git a/src/core/netconnection.h b/src/core/netconnection.h
index d3c6cf7..ddc70f0 100644
--- a/src/core/netconnection.h
+++ b/src/core/netconnection.h
@@ -107,7 +107,7 @@ private:
 
 	bool			receive_compressed;
 	size_t			received_compressed_size;
-	unsigned long		compressed_size;
+	size_t			compressed_size;
 	char			zrecvbuf[BLOCKSIZE];
 };