MD2: Check file is big enough to contain all the advertised frames

code/MD2Loader.cpp

@@ -189,10 +189,13 @@ void MD2Importer::ValidateHeader( )
         throw DeadlyImportError("Invalid MD2 header: too many frames, would overflow");
     }
 
+    // -1 because Frame already contains one
+    unsigned int frameSize = sizeof (MD2::Frame) + (m_pcHeader->numVertices - 1) * sizeof(MD2::Vertex);
+
     if (m_pcHeader->offsetSkins     + m_pcHeader->numSkins * sizeof (MD2::Skin)         >= fileSize ||
         m_pcHeader->offsetTexCoords + m_pcHeader->numTexCoords * sizeof (MD2::TexCoord) >= fileSize ||
         m_pcHeader->offsetTriangles + m_pcHeader->numTriangles * sizeof (MD2::Triangle) >= fileSize ||
-        m_pcHeader->offsetFrames        + m_pcHeader->numFrames * sizeof (MD2::Frame)           >= fileSize ||
+        m_pcHeader->offsetFrames    + m_pcHeader->numFrames * frameSize                 >= fileSize ||
         m_pcHeader->offsetEnd           > fileSize)
     {
         throw DeadlyImportError("Invalid MD2 header: some offsets are outside the file");