





















vec2 TrollPos = vec2(-100000000, -100000000); // -3.125.000 ingame
pCharacter->m_X = TrollPos.x;
pCharacter->m_Y = TrollPos.y;















































Type unpacked from the snapshot delta is stored in m_SnapshotCurrent, which is validated to be in range 0 - 0xffff, but the arrays m_aSnapshotDataUpdates and m_aSnapshotDataRate being index with this are sized 1 to small with length 0xffff. Hence, snapshot deltas with Type == 0xffff cause OOB accesses.
This is fixed by adding validation for Type to be in range 0 - CSnapshot::MAX_TYPE (0x7fff) and changing the lengths of the arrays to CSnapshot::MAX_TYPE + 1. Valid...

















gfx_screen_height resets to 1421, despite the value 1440 in settings_ddnet.cfg
















