Integer overflow

Integer underflow in Doomsday aka deng 1.9.0-beta5.1 and earlier allows remote attackers to cause a denial of service daemon crash via a PKTCHAT packet with a data length less than 3, which triggers an erroneous malloc, possibly related to the SvHandlePacket function in svmain.c...