From fca88d2e98da1c73c04d460b372ae4e336084ffe Mon Sep 17 00:00:00 2001
From: Alam Ed Arias <alam@srb2.org>
Date: Sun, 8 Jan 2017 13:54:52 -0500
Subject: [PATCH 01/34] Mingw: disable GetText support

---
 src/Makefile.cfg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Makefile.cfg b/src/Makefile.cfg
index 72404becc..3630c6367 100644
--- a/src/Makefile.cfg
+++ b/src/Makefile.cfg
@@ -328,7 +328,7 @@ ifdef MINGW
 	INTERFACE=win32
 	NASMFORMAT=win32
 ifndef NOGETTEXT
-	GETTEXT=1
+	#GETTEXT=1
 endif
 	OBJDIR:=$(OBJDIR)/Mingw
 	BIN:=$(BIN)/Mingw

From 55925cabe829156847a27cb3a77d0d3609fa7dc5 Mon Sep 17 00:00:00 2001
From: Alam Ed Arias <alam@srb2.org>
Date: Sun, 8 Jan 2017 14:06:30 -0500
Subject: [PATCH 02/34] win32: fixup printf warnings

---
 src/win32/win_cd.c   | 4 ++--
 src/win32/win_main.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/win32/win_cd.c b/src/win32/win_cd.c
index d73b95523..ae13d3e57 100644
--- a/src/win32/win_cd.c
+++ b/src/win32/win_cd.c
@@ -180,9 +180,9 @@ static LPSTR hms(UINT seconds)
 	hours = minutes / 60;
 	minutes %= 60;
 	if (hours > 0)
-		sprintf (s, "%lu:%02lu:%02lu", hours, minutes, seconds);
+		sprintf (s, "%lu:%02lu:%02lu", (long unsigned int)hours, (long unsigned int)minutes, (long unsigned int)seconds);
 	else
-		sprintf (s, "%2lu:%02lu", minutes, seconds);
+		sprintf (s, "%2lu:%02lu", (long unsigned int)minutes, (long unsigned int)seconds);
 	return s;
 }
 
diff --git a/src/win32/win_main.c b/src/win32/win_main.c
index 663eddbd4..563466dc2 100644
--- a/src/win32/win_main.c
+++ b/src/win32/win_main.c
@@ -470,7 +470,7 @@ static inline BOOL tlErrorMessage(const TCHAR *err)
 	//
 	// warn user if there is one
 	//
-	printf("Error %Ts..\n", err);
+	printf("Error %s..\n", err);
 	fflush(stdout);
 
 	MessageBox(hWndMain, err, TEXT("ERROR"), MB_OK);

From bdcd9125d299cb59c0d3a49be5b2ce0da0f4195c Mon Sep 17 00:00:00 2001
From: toasterbabe <rollerorbital@gmail.com>
Date: Sun, 14 May 2017 14:47:09 +0100
Subject: [PATCH 03/34] Fixed that thing where missiles like sliding up slopes
 for some reason.

This isn't a 1:1 fix for non-slopes - they still like stepping up over the borders of sloped sectors - but this fixes the most egregrious issue.
---
 src/p_mobj.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/p_mobj.c b/src/p_mobj.c
index fb8648013..82640abcf 100644
--- a/src/p_mobj.c
+++ b/src/p_mobj.c
@@ -2363,7 +2363,7 @@ static boolean P_ZMovement(mobj_t *mo)
 			mo->z = mo->floorz;
 
 #ifdef ESLOPE
-		if (mo->standingslope) // You're still on the ground; why are we here?
+		if (!(mo->flags & MF_MISSILE) && mo->standingslope) // You're still on the ground; why are we here?
 		{
 			mo->momz = 0;
 			return true;

From 5a1fc6098ed84aa82bc73afa2640840d17a0845f Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Fri, 19 May 2017 11:25:28 +0100
Subject: [PATCH 04/34] Attempts to prevent stupid stuff from happening

---
 src/d_clisrv.c | 7 ++++++-
 src/d_net.c    | 9 ++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 939d53dec..87e51b447 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3936,6 +3936,9 @@ FILESTAMP
 
 	while (HGetPacket())
 	{
+		if (doomcom->remotenode == -1) // ...this should have been ignored already
+			continue; // might come from PT_NODETIMEOUT somehow though
+
 		node = (SINT8)doomcom->remotenode;
 
 		if (netbuffer->packettype == PT_CLIENTJOIN && server)
@@ -3968,8 +3971,10 @@ FILESTAMP
 		if (netbuffer->packettype == PT_PLAYERINFO)
 			continue; // We do nothing with PLAYERINFO, that's for the MS browser.
 
+		if (node < 0 || node >= MAXNETNODES) // THIS SHOULDN'T EVEN BE POSSIBLE
+			; //CONS_Printf("Received packet from node %d!\n", (int)node);
 		// Packet received from someone already playing
-		if (nodeingame[node])
+		else if (nodeingame[node])
 			HandlePacketFromPlayer(node);
 		// Packet received from someone not playing
 		else
diff --git a/src/d_net.c b/src/d_net.c
index 70cdc5f14..68720f5ee 100644
--- a/src/d_net.c
+++ b/src/d_net.c
@@ -711,6 +711,10 @@ void Net_CloseConnection(INT32 node)
 #else
 	INT32 i;
 	boolean forceclose = (node & FORCECLOSE) != 0;
+
+	if (node == -1)
+		return; // nope, just ignore it
+
 	node &= ~FORCECLOSE;
 
 	if (!node)
@@ -718,7 +722,7 @@ void Net_CloseConnection(INT32 node)
 
 	if (node < 0 || node >= MAXNETNODES) // prevent invalid nodes from crashing the game
 	{
-		CONS_Alert(CONS_WARNING, M_GetText("Net_CloseConnection: invalid node %d detected!\n"), node);
+		//CONS_Alert(CONS_WARNING, M_GetText("Net_CloseConnection: invalid node %d detected!\n"), node);
 		return;
 	}
 
@@ -1128,6 +1132,9 @@ boolean HGetPacket(void)
 			doomcom->remotenode = 0;
 
 		rebound_tail = (rebound_tail+1) % MAXREBOUND;
+
+		if (doomcom->remotenode == -1) // wait hang on what?
+			return true; // there might still be packets from others though, so don't return false
 #ifdef DEBUGFILE
 		if (debugfile)
 			DebugPrintpacket("GETLOCAL");

From 1078a642dfee676cf87fcb023d9b8889477ae959 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Fri, 19 May 2017 11:52:50 +0100
Subject: [PATCH 05/34] Loop through rebound packets until you found a good one
 or ran out of them

---
 src/d_net.c | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/src/d_net.c b/src/d_net.c
index 68720f5ee..8f11f60fc 100644
--- a/src/d_net.c
+++ b/src/d_net.c
@@ -1124,22 +1124,27 @@ boolean HGetPacket(void)
 	// Get a packet from self
 	if (rebound_tail != rebound_head)
 	{
-		M_Memcpy(netbuffer, &reboundstore[rebound_tail], reboundsize[rebound_tail]);
-		doomcom->datalength = reboundsize[rebound_tail];
-		if (netbuffer->packettype == PT_NODETIMEOUT)
-			doomcom->remotenode = netbuffer->u.textcmd[0];
-		else
-			doomcom->remotenode = 0;
+		while (true) // loop until we found a valid packet, or we ran out of packets
+		{ // provided MAXREBOUND is not all that large this shouldn't take too long
+			if (rebound_tail == rebound_head)
+				break; // just give up, none of them were any good somehow
+			M_Memcpy(netbuffer, &reboundstore[rebound_tail], reboundsize[rebound_tail]);
+			doomcom->datalength = reboundsize[rebound_tail];
+			if (netbuffer->packettype == PT_NODETIMEOUT)
+				doomcom->remotenode = netbuffer->u.textcmd[0];
+			else
+				doomcom->remotenode = 0;
 
-		rebound_tail = (rebound_tail+1) % MAXREBOUND;
+			rebound_tail = (rebound_tail+1) % MAXREBOUND;
 
-		if (doomcom->remotenode == -1) // wait hang on what?
-			return true; // there might still be packets from others though, so don't return false
+			if (doomcom->remotenode == -1) // wait hang on what?
+				continue; // ignore it, look for the next packet
 #ifdef DEBUGFILE
-		if (debugfile)
-			DebugPrintpacket("GETLOCAL");
+			if (debugfile)
+				DebugPrintpacket("GETLOCAL");
 #endif
-		return true;
+			return true;
+		}
 	}
 
 	if (!netgame)

From 284e539c66817d2448781a29024818d1c620a29c Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Fri, 19 May 2017 16:31:23 +0100
Subject: [PATCH 06/34] Don't bail out in Y_StartIntermission in dedicated
 mode, this causes the game not to add on score bonuses for players from the
 server's view of things!

---
 src/y_inter.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/y_inter.c b/src/y_inter.c
index b2e1cdf9f..2fd37ff33 100644
--- a/src/y_inter.c
+++ b/src/y_inter.c
@@ -965,7 +965,8 @@ void Y_StartIntermission(void)
 	}
 
 	// We couldn't display the intermission even if we wanted to.
-	if (dedicated) return;
+	// But we still need to give the players their score bonuses, dummy.
+	//if (dedicated) return;
 
 	// This should always exist, but just in case...
 	if(!mapheaderinfo[prevmap])

From 5aeb4b591949399676d0e5e3e358e539115f0e43 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Sat, 20 May 2017 21:29:05 +0100
Subject: [PATCH 07/34] Revert "Loop through rebound packets until you found a
 good one or ran out of them"

On second thought, this was probably unnecessary anyway.

This reverts commit 1078a642dfee676cf87fcb023d9b8889477ae959.
---
 src/d_net.c | 29 ++++++++++++-----------------
 1 file changed, 12 insertions(+), 17 deletions(-)

diff --git a/src/d_net.c b/src/d_net.c
index 8f11f60fc..68720f5ee 100644
--- a/src/d_net.c
+++ b/src/d_net.c
@@ -1124,27 +1124,22 @@ boolean HGetPacket(void)
 	// Get a packet from self
 	if (rebound_tail != rebound_head)
 	{
-		while (true) // loop until we found a valid packet, or we ran out of packets
-		{ // provided MAXREBOUND is not all that large this shouldn't take too long
-			if (rebound_tail == rebound_head)
-				break; // just give up, none of them were any good somehow
-			M_Memcpy(netbuffer, &reboundstore[rebound_tail], reboundsize[rebound_tail]);
-			doomcom->datalength = reboundsize[rebound_tail];
-			if (netbuffer->packettype == PT_NODETIMEOUT)
-				doomcom->remotenode = netbuffer->u.textcmd[0];
-			else
-				doomcom->remotenode = 0;
+		M_Memcpy(netbuffer, &reboundstore[rebound_tail], reboundsize[rebound_tail]);
+		doomcom->datalength = reboundsize[rebound_tail];
+		if (netbuffer->packettype == PT_NODETIMEOUT)
+			doomcom->remotenode = netbuffer->u.textcmd[0];
+		else
+			doomcom->remotenode = 0;
 
-			rebound_tail = (rebound_tail+1) % MAXREBOUND;
+		rebound_tail = (rebound_tail+1) % MAXREBOUND;
 
-			if (doomcom->remotenode == -1) // wait hang on what?
-				continue; // ignore it, look for the next packet
+		if (doomcom->remotenode == -1) // wait hang on what?
+			return true; // there might still be packets from others though, so don't return false
 #ifdef DEBUGFILE
-			if (debugfile)
-				DebugPrintpacket("GETLOCAL");
+		if (debugfile)
+			DebugPrintpacket("GETLOCAL");
 #endif
-			return true;
-		}
+		return true;
 	}
 
 	if (!netgame)

From 247ed56e1790caa0a69f9f1027dfcb0d0fb5b8e8 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Mon, 22 May 2017 16:44:50 +0100
Subject: [PATCH 08/34] Don't allow nonsense PT_ASKINFOVIAMS packets, nor any
 at all if offline

---
 src/d_clisrv.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 87e51b447..098430230 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3405,13 +3405,23 @@ static void HandlePacketFromAwayNode(SINT8 node)
 	switch (netbuffer->packettype)
 	{
 		case PT_ASKINFOVIAMS:
+			if (ms_RoomId < 0) // ignore if we're not actually on the MS right now
+			{
+				Net_CloseConnection(node); // and yes, close connection
+				break;
+			}
 			if (server && serverrunning)
 			{
 				INT32 clientnode = I_NetMakeNode(netbuffer->u.msaskinfo.clientaddr);
-				SV_SendServerInfo(clientnode, (tic_t)LONG(netbuffer->u.msaskinfo.time));
-				SV_SendPlayerInfo(clientnode); // Send extra info
-				Net_CloseConnection(clientnode);
-				// Don't close connection to MS.
+				if (clientnode != -1)
+				{
+					SV_SendServerInfo(clientnode, (tic_t)LONG(netbuffer->u.msaskinfo.time));
+					SV_SendPlayerInfo(clientnode); // Send extra info
+					Net_CloseConnection(clientnode);
+					// Don't close connection to MS...
+				}
+				else
+					Net_CloseConnection(node); // ...unless the IP address is not valid
 			}
 			break;
 

From 28444c12dd6d57ae43d08186a40dd5b5e8b43019 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Mon, 22 May 2017 16:54:39 +0100
Subject: [PATCH 09/34] Some more things I overlooked in this fix

---
 src/d_clisrv.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 098430230..17f0b7743 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3405,14 +3405,16 @@ static void HandlePacketFromAwayNode(SINT8 node)
 	switch (netbuffer->packettype)
 	{
 		case PT_ASKINFOVIAMS:
-			if (ms_RoomId < 0) // ignore if we're not actually on the MS right now
-			{
-				Net_CloseConnection(node); // and yes, close connection
-				break;
-			}
+
 			if (server && serverrunning)
 			{
-				INT32 clientnode = I_NetMakeNode(netbuffer->u.msaskinfo.clientaddr);
+				INT32 clientnode;
+				if (ms_RoomId < 0) // ignore if we're not actually on the MS right now
+				{
+					Net_CloseConnection(node); // and yes, close connection
+					return;
+				}
+				clientnode = I_NetMakeNode(netbuffer->u.msaskinfo.clientaddr);
 				if (clientnode != -1)
 				{
 					SV_SendServerInfo(clientnode, (tic_t)LONG(netbuffer->u.msaskinfo.time));
@@ -3423,6 +3425,8 @@ static void HandlePacketFromAwayNode(SINT8 node)
 				else
 					Net_CloseConnection(node); // ...unless the IP address is not valid
 			}
+			else
+				Net_CloseConnection(node); // you're not supposed to get it, so ignore it
 			break;
 
 		case PT_ASKINFO:

From 3784d765e493d7820f7dd37b5d4c3c66ef7a3f8a Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Mon, 22 May 2017 20:47:38 +0100
Subject: [PATCH 10/34] Remove extra whitespace I added

---
 src/d_clisrv.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 17f0b7743..36b03be63 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3405,7 +3405,6 @@ static void HandlePacketFromAwayNode(SINT8 node)
 	switch (netbuffer->packettype)
 	{
 		case PT_ASKINFOVIAMS:
-
 			if (server && serverrunning)
 			{
 				INT32 clientnode;

From c70839334e180869279c84f5d40360afdcc43bdc Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Mon, 22 May 2017 22:17:51 +0100
Subject: [PATCH 11/34] Added a bunch of missing checks to prevent non-server
 players from sending other non-server players stuff

---
 src/d_clisrv.c | 40 +++++++++++++++++++++++++++++++++++++---
 1 file changed, 37 insertions(+), 3 deletions(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 36b03be63..c6b8bbd64 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3433,8 +3433,8 @@ static void HandlePacketFromAwayNode(SINT8 node)
 			{
 				SV_SendServerInfo(node, (tic_t)LONG(netbuffer->u.askinfo.time));
 				SV_SendPlayerInfo(node); // Send extra info
-				Net_CloseConnection(node);
 			}
+			Net_CloseConnection(node);
 			break;
 
 		case PT_SERVERREFUSE: // Negative response of client join request
@@ -3443,6 +3443,11 @@ static void HandlePacketFromAwayNode(SINT8 node)
 				Net_CloseConnection(node);
 				break;
 			}
+			if (node != servernode) // nope you're not the server
+			{
+				Net_CloseConnection(node);
+				break;
+			}
 			if (cl_mode == CL_WAITJOINRESPONSE)
 			{
 				// Save the reason so it can be displayed after quitting the netgame
@@ -3474,6 +3479,11 @@ static void HandlePacketFromAwayNode(SINT8 node)
 				Net_CloseConnection(node);
 				break;
 			}
+			if (node != servernode) // nope you're not the server
+			{
+				Net_CloseConnection(node);
+				break;
+			}
 			/// \note how would this happen? and is it doing the right thing if it does?
 			if (cl_mode != CL_WAITJOINRESPONSE)
 				break;
@@ -3537,11 +3547,20 @@ static void HandlePacketFromAwayNode(SINT8 node)
 				Net_CloseConnection(node);
 				break;
 			}
-			else
-				Got_Filetxpak();
+			if (node != servernode) // nope you're not the server
+			{
+				Net_CloseConnection(node);
+				break;
+			}
+			Got_Filetxpak();
 			break;
 
 		case PT_REQUESTFILE:
+			if (node != servernode) // nope you're not the server
+			{
+				Net_CloseConnection(node);
+				break;
+			}
 			if (server)
 				Got_RequestFilePak(node);
 			break;
@@ -3926,6 +3945,21 @@ FILESTAMP
 		case PT_SERVERCFG:
 			break;
 		case PT_FILEFRAGMENT:
+			// Only accept PT_FILEFRAGMENT from the server.
+			if (node != servernode)
+			{
+				CONS_Alert(CONS_WARNING, M_GetText("%s received from non-host %d\n"), "PT_FILEFRAGMENT", node);
+
+				if (server)
+				{
+					XBOXSTATIC UINT8 buf[2];
+					buf[0] = (UINT8)node;
+					buf[1] = KICK_MSG_CON_FAIL;
+					SendNetXCmd(XD_KICK, &buf, 2);
+				}
+
+				break;
+			}
 			if (client)
 				Got_Filetxpak();
 			break;

From fdfd6e1c0bbce1c7c584a906a7b51f7907eba5bb Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Mon, 22 May 2017 22:20:08 +0100
Subject: [PATCH 12/34] Whoops don't do that for PT_REQUESTFILE

---
 src/d_clisrv.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index c6b8bbd64..762624612 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3556,11 +3556,6 @@ static void HandlePacketFromAwayNode(SINT8 node)
 			break;
 
 		case PT_REQUESTFILE:
-			if (node != servernode) // nope you're not the server
-			{
-				Net_CloseConnection(node);
-				break;
-			}
 			if (server)
 				Got_RequestFilePak(node);
 			break;

From 9e3bdc5ee229c061db3550eda3c4cf1c7e4a35fb Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Tue, 23 May 2017 16:13:42 +0100
Subject: [PATCH 13/34] Prevent bad PT_TEXTCMD/PT_TEXTCMD2 textcmd[0] sizes?

---
 src/d_clisrv.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 762624612..4700fcb88 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3737,6 +3737,15 @@ FILESTAMP
 				tic_t tic = maketic;
 				UINT8 *textcmd;
 
+				// ignore if the textcmd size var is actually larger than it should be
+				if (BASEPACKETSIZE + netbuffer->u.textcmd[0] > (size_t)doomcom->datalength)
+				{
+					DEBFILE(va("GetPacket: Bad Textcmd packet size! (expected %d, actual %d)\n",
+					BASEPACKETSIZE + netbuffer->u.textcmd[0], doomcom->datalength));
+					Net_UnAcknowledgePacket(node);
+					break;
+				}
+
 				// check if tic that we are making isn't too large else we cannot send it :(
 				// doomcom->numslots+1 "+1" since doomcom->numslots can change within this time and sent time
 				j = software_MAXPACKETLENGTH

From ff1cc07a1d20989c0271dc8c875a4d3b248aea94 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Tue, 23 May 2017 16:29:09 +0100
Subject: [PATCH 14/34] Implemented toaster's suggestion to make a macro here

---
 src/d_clisrv.c | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 4700fcb88..246642b98 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3402,6 +3402,14 @@ static void HandlePacketFromAwayNode(SINT8 node)
 	if (node != servernode)
 		DEBFILE(va("Received packet from unknown host %d\n", node));
 
+// macro for packets that should only be sent by the server
+// if it is NOT from the server, bail out and close the connection!
+#define SERVERONLY \
+			if (node != servernode) \
+			{ \
+				Net_CloseConnection(node); \
+				break; \
+			}
 	switch (netbuffer->packettype)
 	{
 		case PT_ASKINFOVIAMS:
@@ -3443,11 +3451,7 @@ static void HandlePacketFromAwayNode(SINT8 node)
 				Net_CloseConnection(node);
 				break;
 			}
-			if (node != servernode) // nope you're not the server
-			{
-				Net_CloseConnection(node);
-				break;
-			}
+			SERVERONLY
 			if (cl_mode == CL_WAITJOINRESPONSE)
 			{
 				// Save the reason so it can be displayed after quitting the netgame
@@ -3479,11 +3483,7 @@ static void HandlePacketFromAwayNode(SINT8 node)
 				Net_CloseConnection(node);
 				break;
 			}
-			if (node != servernode) // nope you're not the server
-			{
-				Net_CloseConnection(node);
-				break;
-			}
+			SERVERONLY
 			/// \note how would this happen? and is it doing the right thing if it does?
 			if (cl_mode != CL_WAITJOINRESPONSE)
 				break;
@@ -3547,11 +3547,7 @@ static void HandlePacketFromAwayNode(SINT8 node)
 				Net_CloseConnection(node);
 				break;
 			}
-			if (node != servernode) // nope you're not the server
-			{
-				Net_CloseConnection(node);
-				break;
-			}
+			SERVERONLY
 			Got_Filetxpak();
 			break;
 
@@ -3580,6 +3576,7 @@ static void HandlePacketFromAwayNode(SINT8 node)
 			break; // Ignore it
 
 	}
+#undef SERVERONLY
 }
 
 /** Handles a packet received from a node that is in game

From 0b0b738a6f8af4ceb95c05de44f42da11b550408 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Tue, 23 May 2017 16:34:56 +0100
Subject: [PATCH 15/34] Don't allow non-servers to receive PT_RESYNCHGET

---
 src/d_clisrv.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 246642b98..186c25e6a 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3609,6 +3609,8 @@ FILESTAMP
 	{
 // -------------------------------------------- SERVER RECEIVE ----------
 		case PT_RESYNCHGET:
+			if (client)
+				break;
 			SV_AcknowledgeResynchAck(netconsole, netbuffer->u.resynchgot);
 			break;
 		case PT_CLIENTCMD:

From 7147e0fcafcdf89f65bb2e909e94ea575cdbc3d9 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Tue, 23 May 2017 17:35:32 +0100
Subject: [PATCH 16/34] Improve previous PT_TEXTCMD/PT_TEXTCMD2 check, add
 another one to ignore zero size textcmds!

---
 src/d_clisrv.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 186c25e6a..a42fcf1d1 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3736,11 +3736,23 @@ FILESTAMP
 				tic_t tic = maketic;
 				UINT8 *textcmd;
 
-				// ignore if the textcmd size var is actually larger than it should be
-				if (BASEPACKETSIZE + netbuffer->u.textcmd[0] > (size_t)doomcom->datalength)
+				// ignore if the textcmd has a reported size of zero
+				// this shouldn't be sent at all
+				if (!netbuffer->u.textcmd[0])
 				{
-					DEBFILE(va("GetPacket: Bad Textcmd packet size! (expected %d, actual %d)\n",
-					BASEPACKETSIZE + netbuffer->u.textcmd[0], doomcom->datalength));
+					DEBFILE(va("GetPacket: Textcmd with size 0 detected! (node %u, player %d)\n",
+						node, netconsole));
+					Net_UnAcknowledgePacket(node);
+					break;
+				}
+
+				// ignore if the textcmd size var is actually larger than it should be
+				// BASEPACKETSIZE + 1 (for size) + textcmd[0] should == datalength
+				if (netbuffer->u.textcmd[0] > (size_t)doomcom->datalength-BASEPACKETSIZE-1)
+				{
+					DEBFILE(va("GetPacket: Bad Textcmd packet size! (expected %d, actual %d, node %u, player %d)\n",
+					netbuffer->u.textcmd[0], (size_t)doomcom->datalength-BASEPACKETSIZE-1,
+						node, netconsole));
 					Net_UnAcknowledgePacket(node);
 					break;
 				}

From c92aaa74a41e3ad2477b564eaa9bfe086b518450 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Tue, 23 May 2017 18:46:34 +0100
Subject: [PATCH 17/34] I think PT_CLIENT2MIS was meant to do this too,
 probably

---
 src/d_clisrv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index a42fcf1d1..27fcd0672 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3677,7 +3677,8 @@ FILESTAMP
 			}
 
 			// Splitscreen cmd
-			if (netbuffer->packettype == PT_CLIENT2CMD && nodetoplayer2[node] >= 0)
+			if ((netbuffer->packettype == PT_CLIENT2CMD || netbuffer->packettype == PT_CLIENT2MIS)
+				&& nodetoplayer2[node] >= 0)
 				G_MoveTiccmd(&netcmds[maketic%BACKUPTICS][(UINT8)nodetoplayer2[node]],
 					&netbuffer->u.client2pak.cmd2, 1);
 

From 2aa1215716c28f06a5be7cc3aefc2e7626d22e2c Mon Sep 17 00:00:00 2001
From: toasterbabe <rollerorbital@gmail.com>
Date: Thu, 25 May 2017 15:22:32 +0100
Subject: [PATCH 18/34] Fix a thing where the host adds a WAD and you have too
 many WADs loaded to add it.

---
 src/d_netcmd.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/d_netcmd.c b/src/d_netcmd.c
index 478772ed9..0434e7e4b 100644
--- a/src/d_netcmd.c
+++ b/src/d_netcmd.c
@@ -3180,10 +3180,15 @@ static void Got_Addfilecmd(UINT8 **cp, INT32 playernum)
 
 	ncs = findfile(filename,md5sum,true);
 
-	if (ncs != FS_FOUND)
+	if (ncs != FS_FOUND || !P_AddWadFile(filename, NULL))
 	{
 		Command_ExitGame_f();
-		if (ncs == FS_NOTFOUND)
+		if (ncs == FS_FOUND)
+		{
+			CONS_Printf(M_GetText("The server tried to add %s,\nbut you have too many files added.\nRestart the game to clear loaded files\nand play on this server."), filename);
+			M_StartMessage(va("The server added a file \n(%s)\nbut you have too many files added.\nRestart the game to clear loaded files.\n\nPress ESC\n",filename), NULL, MM_NOTHING);
+		}
+		else if (ncs == FS_NOTFOUND)
 		{
 			CONS_Printf(M_GetText("The server tried to add %s,\nbut you don't have this file.\nYou need to find it in order\nto play on this server."), filename);
 			M_StartMessage(va("The server added a file \n(%s)\nthat you do not have.\n\nPress ESC\n",filename), NULL, MM_NOTHING);
@@ -3201,7 +3206,6 @@ static void Got_Addfilecmd(UINT8 **cp, INT32 playernum)
 		return;
 	}
 
-	P_AddWadFile(filename, NULL);
 	G_SetGameModified(true);
 }
 

From 5c302d7ffcdce40003016b2fc4cb81a35606c252 Mon Sep 17 00:00:00 2001
From: toasterbabe <rollerorbital@gmail.com>
Date: Thu, 25 May 2017 15:34:21 +0100
Subject: [PATCH 19/34] Partial implementation of fix for Got_RequestAddfilecmd
 (the other half - the limitation on the size of the filesneeded section of
 the serverinfo packet - will be applied in internal.)

---
 src/d_netcmd.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/d_netcmd.c b/src/d_netcmd.c
index 0434e7e4b..f4916756c 100644
--- a/src/d_netcmd.c
+++ b/src/d_netcmd.c
@@ -3078,6 +3078,7 @@ static void Got_RequestAddfilecmd(UINT8 **cp, INT32 playernum)
 	filestatus_t ncs = FS_NOTFOUND;
 	UINT8 md5sum[16];
 	boolean kick = false;
+	boolean toomany = false;
 	INT32 i;
 
 	READSTRINGN(*cp, filename, 240);
@@ -3104,13 +3105,18 @@ static void Got_RequestAddfilecmd(UINT8 **cp, INT32 playernum)
 		return;
 	}
 
-	ncs = findfile(filename,md5sum,true);
+	if (numwadfiles >= MAX_WADFILES) // a more comprehensive check in internal; bare minimum of out-of-bounds for public next
+		toomany = true;
+	else
+		ncs = findfile(filename,md5sum,true);
 
-	if (ncs != FS_FOUND)
+	if (ncs != FS_FOUND || toomany)
 	{
 		char message[256];
 
-		if (ncs == FS_NOTFOUND)
+		if (toomany)
+			sprintf(message, M_GetText("Too many files loaded to add %s\n"), filename);
+		else if (ncs == FS_NOTFOUND)
 			sprintf(message, M_GetText("The server doesn't have %s\n"), filename);
 		else if (ncs == FS_MD5SUMBAD)
 			sprintf(message, M_GetText("Checksum mismatch on %s\n"), filename);

From 47e171250f88c4d12f4b594213e159d01d592d1b Mon Sep 17 00:00:00 2001
From: toasterbabe <rollerorbital@gmail.com>
Date: Thu, 25 May 2017 16:06:39 +0100
Subject: [PATCH 20/34] * Prevent joining a server if you have too many files
 loaded to add the remainder. * Made the check in Got_RequestAddfilecmd more
 comprehensive, since I might as well. Just something to tweak a little later
 in internal.

---
 src/d_clisrv.c | 17 ++++++++++++++---
 src/d_netcmd.c | 14 +++++++++++++-
 src/d_netfil.c | 15 +++++++++++++++
 3 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 939d53dec..76b5c95d5 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -1733,9 +1733,7 @@ static boolean CL_ServerConnectionSearchTicker(boolean viams, tic_t *asksent)
 {
 #ifndef NONET
 	INT32 i;
-#endif
 
-#ifndef NONET
 	// serverlist is updated by GetPacket function
 	if (serverlistcount > 0)
 	{
@@ -1769,7 +1767,20 @@ static boolean CL_ServerConnectionSearchTicker(boolean viams, tic_t *asksent)
 				serverlist[i].info.fileneeded);
 			CONS_Printf(M_GetText("Checking files...\n"));
 			i = CL_CheckFiles();
-			if (i == 2) // cannot join for some reason
+			if (i == 3) // too many files
+			{
+				D_QuitNetGame();
+				CL_Reset();
+				D_StartTitle();
+				M_StartMessage(M_GetText(
+					"You have too many WAD files loaded\n"
+					"to add ones the server is using.\n"
+					"Please restart SRB2 before connecting.\n\n"
+					"Press ESC\n"
+				), NULL, MM_NOTHING);
+				return false;
+			}
+			else if (i == 2) // cannot join for some reason
 			{
 				D_QuitNetGame();
 				CL_Reset();
diff --git a/src/d_netcmd.c b/src/d_netcmd.c
index f4916756c..d7bbb0aa1 100644
--- a/src/d_netcmd.c
+++ b/src/d_netcmd.c
@@ -3080,6 +3080,11 @@ static void Got_RequestAddfilecmd(UINT8 **cp, INT32 playernum)
 	boolean kick = false;
 	boolean toomany = false;
 	INT32 i;
+	size_t packetsize = 0;
+	serverinfo_pak *dummycheck = NULL;
+
+	// Shut the compiler up.
+	(void)dummycheck;
 
 	READSTRINGN(*cp, filename, 240);
 	READMEM(*cp, md5sum, 16);
@@ -3105,7 +3110,14 @@ static void Got_RequestAddfilecmd(UINT8 **cp, INT32 playernum)
 		return;
 	}
 
-	if (numwadfiles >= MAX_WADFILES) // a more comprehensive check in internal; bare minimum of out-of-bounds for public next
+	// See W_LoadWadFile in w_wad.c
+	for (i = 0; i < numwadfiles; i++)
+		packetsize += nameonlylength(wadfiles[i]->filename) + 22;
+
+	packetsize += nameonlylength(filename) + 22;
+
+	if ((numwadfiles >= MAX_WADFILES)
+	|| (packetsize > sizeof(dummycheck->fileneeded)))
 		toomany = true;
 	else
 		ncs = findfile(filename,md5sum,true);
diff --git a/src/d_netfil.c b/src/d_netfil.c
index bf4e59878..479fd60de 100644
--- a/src/d_netfil.c
+++ b/src/d_netfil.c
@@ -330,6 +330,11 @@ INT32 CL_CheckFiles(void)
 	INT32 i, j;
 	char wadfilename[MAX_WADPATH];
 	INT32 ret = 1;
+	size_t packetsize = 0;
+	serverinfo_pak *dummycheck = NULL;
+
+	// Shut the compiler up.
+	(void)dummycheck;
 
 //	if (M_CheckParm("-nofiles"))
 //		return 1;
@@ -378,6 +383,10 @@ INT32 CL_CheckFiles(void)
 		return 1;
 	}
 
+	// See W_LoadWadFile in w_wad.c
+	for (i = 0; i < numwadfiles; i++)
+		packetsize += nameonlylength(wadfiles[i]->filename) + 22;
+
 	for (i = 1; i < fileneedednum; i++)
 	{
 		CONS_Debug(DBG_NETPLAY, "searching for '%s' ", fileneeded[i].filename);
@@ -397,6 +406,12 @@ INT32 CL_CheckFiles(void)
 		if (fileneeded[i].status != FS_NOTFOUND || !fileneeded[i].important)
 			continue;
 
+		packetsize += nameonlylength(fileneeded[i].filename) + 22;
+
+		if ((numwadfiles >= MAX_WADFILES)
+		|| (packetsize > sizeof(dummycheck->fileneeded)))
+			return 3;
+
 		fileneeded[i].status = findfile(fileneeded[i].filename, fileneeded[i].md5sum, true);
 		CONS_Debug(DBG_NETPLAY, "found %d\n", fileneeded[i].status);
 		if (fileneeded[i].status != FS_FOUND)

From 58236af6f73f535f5071d5fca84457b993239f5d Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Thu, 25 May 2017 16:55:59 +0100
Subject: [PATCH 21/34] Tweak to D_MapChange: if you failed to start a server,
 DON'T send a map change command

---
 src/d_netcmd.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/d_netcmd.c b/src/d_netcmd.c
index 478772ed9..f23549315 100644
--- a/src/d_netcmd.c
+++ b/src/d_netcmd.c
@@ -1569,8 +1569,13 @@ void D_MapChange(INT32 mapnum, INT32 newgametype, boolean pultmode, boolean rese
 		mapchangepending = 0;
 		// spawn the server if needed
 		// reset players if there is a new one
-		if (!(adminplayer == consoleplayer) && SV_SpawnServer())
-			buf[0] &= ~(1<<1);
+		if (!(adminplayer == consoleplayer))
+		{
+			if (SV_SpawnServer())
+				buf[0] &= ~(1<<1);
+			if (!Playing()) // you failed to start a server somehow, so cancel the map change
+				return;
+		}
 
 		// Kick bot from special stages
 		if (botskin)

From a23e9bc32b6357f5e366246dada0aa55c34c235b Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Thu, 25 May 2017 18:10:20 +0100
Subject: [PATCH 22/34] Fix size_t printing

---
 src/d_clisrv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 27fcd0672..c095d38a5 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3751,8 +3751,8 @@ FILESTAMP
 				// BASEPACKETSIZE + 1 (for size) + textcmd[0] should == datalength
 				if (netbuffer->u.textcmd[0] > (size_t)doomcom->datalength-BASEPACKETSIZE-1)
 				{
-					DEBFILE(va("GetPacket: Bad Textcmd packet size! (expected %d, actual %d, node %u, player %d)\n",
-					netbuffer->u.textcmd[0], (size_t)doomcom->datalength-BASEPACKETSIZE-1,
+					DEBFILE(va("GetPacket: Bad Textcmd packet size! (expected %d, actual %s, node %u, player %d)\n",
+					netbuffer->u.textcmd[0], sizeu1((size_t)doomcom->datalength-BASEPACKETSIZE-1),
 						node, netconsole));
 					Net_UnAcknowledgePacket(node);
 					break;

From 437780d503e8cac007d9dcc7a30c410bb08a7365 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Thu, 25 May 2017 18:40:48 +0100
Subject: [PATCH 23/34] Add missing break for MT_EGGCAPSULE's switch case in
 P_SpawnMobj (sorry!)

---
 src/p_mobj.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/p_mobj.c b/src/p_mobj.c
index fb8648013..47886ce8f 100644
--- a/src/p_mobj.c
+++ b/src/p_mobj.c
@@ -7807,6 +7807,7 @@ mobj_t *P_SpawnMobj(fixed_t x, fixed_t y, fixed_t z, mobjtype_t type)
 			break;
 		case MT_EGGCAPSULE:
 			mobj->extravalue1 = -1; // timer for how long a player has been at the capsule
+			break;
 		case MT_REDTEAMRING:
 			mobj->color = skincolor_redteam;
 			break;

From aecc97ded33bbfd7e8e62aca333398a14b3c06d5 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Fri, 26 May 2017 13:39:54 +0100
Subject: [PATCH 24/34] PT_REQUESTFILE checking:

* if you sent it to a client rather than the server, game over, your connection is closed
* if files that don't exist or are too large are requested are listed, game over, your connection is closed (they should have been checked on YOUR side beforehand, silly)
* if the server has downloading disabled anyway, ...yeah, you get the idea

Don't worry, I made sure Got_RequestFilePak cleaned up the full file request list for the node in case of failure
---
 src/d_clisrv.c |  7 +++++-
 src/d_netfil.c | 64 +++++++++++++++++++++++++++++++++++++++++++++-----
 src/d_netfil.h |  2 +-
 3 files changed, 65 insertions(+), 8 deletions(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index c095d38a5..2fc895c23 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3553,7 +3553,12 @@ static void HandlePacketFromAwayNode(SINT8 node)
 
 		case PT_REQUESTFILE:
 			if (server)
-				Got_RequestFilePak(node);
+			{
+				if (!cv_downloading.value || !Got_RequestFilePak(node))
+					Net_CloseConnection(node); // close connection if one of the requested files could not be sent, or you disabled downloading anyway
+			}
+			else
+				Net_CloseConnection(node); // nope
 			break;
 
 		case PT_NODETIMEOUT:
diff --git a/src/d_netfil.c b/src/d_netfil.c
index bf4e59878..777814cee 100644
--- a/src/d_netfil.c
+++ b/src/d_netfil.c
@@ -62,7 +62,9 @@
 
 #include <errno.h>
 
-static void SV_SendFile(INT32 node, const char *filename, UINT8 fileid);
+// Prototypes
+static boolean SV_SendFile(INT32 node, const char *filename, UINT8 fileid);
+static void SV_RemoveFileSendList(INT32 node);
 
 // Sender structure
 typedef struct filetx_s
@@ -303,7 +305,8 @@ boolean CL_SendRequestFile(void)
 }
 
 // get request filepak and put it on the send queue
-void Got_RequestFilePak(INT32 node)
+// returns false if a requested file was not found or cannot be sent
+boolean Got_RequestFilePak(INT32 node)
 {
 	char wad[MAX_WADPATH+1];
 	UINT8 *p = netbuffer->u.textcmd;
@@ -314,8 +317,13 @@ void Got_RequestFilePak(INT32 node)
 		if (id == 0xFF)
 			break;
 		READSTRINGN(p, wad, MAX_WADPATH);
-		SV_SendFile(node, wad, id);
+		if (!SV_SendFile(node, wad, id))
+		{
+			SV_RemoveFileSendList(node);
+			return false; // don't read the rest of the files
+		}
 	}
+	return true; // no problems with any files
 }
 
 /** Checks if the files needed aren't already loaded or on the disk
@@ -480,7 +488,7 @@ static INT32 filestosend = 0;
   * \sa SV_SendRam
   *
   */
-static void SV_SendFile(INT32 node, const char *filename, UINT8 fileid)
+static boolean SV_SendFile(INT32 node, const char *filename, UINT8 fileid)
 {
 	filetx_t **q; // A pointer to the "next" field of the last file in the list
 	filetx_t *p; // The new file request
@@ -537,7 +545,7 @@ static void SV_SendFile(INT32 node, const char *filename, UINT8 fileid)
 		free(p->id.filename);
 		free(p);
 		*q = NULL;
-		return;
+		return false; // cancel the rest of the requests
 	}
 
 	// Handle huge file requests (i.e. bigger than cv_maxsend.value KB)
@@ -549,7 +557,7 @@ static void SV_SendFile(INT32 node, const char *filename, UINT8 fileid)
 		free(p->id.filename);
 		free(p);
 		*q = NULL;
-		return;
+		return false; // cancel the rest of the requests
 	}
 
 	DEBFILE(va("Sending file %s (id=%d) to %d\n", filename, fileid, node));
@@ -557,6 +565,7 @@ static void SV_SendFile(INT32 node, const char *filename, UINT8 fileid)
 	p->fileid = fileid;
 	p->next = NULL; // End of list
 	filestosend++;
+	return true;
 }
 
 /** Adds a memory block to the file list for a node
@@ -598,6 +607,49 @@ void SV_SendRam(INT32 node, void *data, size_t size, freemethod_t freemethod, UI
 	filestosend++;
 }
 
+/** Removes all file requests for a node
+  * This is needed only if a PT_REQUESTFILE's content gave you something that shouldn't be there
+  *
+  * \param node The destination
+  * \sa Got_RequestFilePak
+  *
+  */
+static void SV_RemoveFileSendList(INT32 node)
+{
+	filetx_t *p = transfer[node].txlist;
+
+	if (p == NULL)
+		return; // ...well, that was easy
+
+	while (p)
+	{
+		// Free the file request according to the freemethod parameter used with SV_SendFile/Ram
+		switch (p->ram)
+		{
+			case SF_FILE: // It's a file, close it and free its filename
+				if (cv_noticedownload.value)
+					CONS_Printf("Cancelling file transfer for node %d\n", node);
+				if (transfer[node].currentfile)
+					fclose(transfer[node].currentfile);
+				free(p->id.filename);
+				break;
+			case SF_Z_RAM: // It's a memory block allocated with Z_Alloc or the likes, use Z_Free
+				Z_Free(p->id.ram);
+				break;
+			case SF_RAM: // It's a memory block allocated with malloc, use free
+				free(p->id.ram);
+			case SF_NOFREERAM: // Nothing to free
+				break;
+		}
+		// Remove the file request from the list
+		transfer[node].txlist = p->next;
+		free(p);
+		// Indicate that the transmission is over (if for some reason it had started)
+		transfer[node].currentfile = NULL;
+		filestosend--;
+	}
+}
+
 /** Stops sending a file for a node, and removes the file request from the list,
   * either because the file has been fully sent or because the node was disconnected
   *
diff --git a/src/d_netfil.h b/src/d_netfil.h
index c9085a5b0..b9b7b2f2e 100644
--- a/src/d_netfil.h
+++ b/src/d_netfil.h
@@ -69,7 +69,7 @@ boolean SV_SendingFile(INT32 node);
 
 boolean CL_CheckDownloadable(void);
 boolean CL_SendRequestFile(void);
-void Got_RequestFilePak(INT32 node);
+boolean Got_RequestFilePak(INT32 node);
 
 void SV_AbortSendFiles(INT32 node);
 void CloseNetFile(void);

From 7979f84e258769cf230610a6cd7b4c0161479ba4 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Fri, 26 May 2017 13:58:34 +0100
Subject: [PATCH 25/34] whoops

---
 src/d_netfil.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/d_netfil.c b/src/d_netfil.c
index 777814cee..8704e05ce 100644
--- a/src/d_netfil.c
+++ b/src/d_netfil.c
@@ -644,6 +644,7 @@ static void SV_RemoveFileSendList(INT32 node)
 		// Remove the file request from the list
 		transfer[node].txlist = p->next;
 		free(p);
+		p = transfer[node].txlist;
 		// Indicate that the transmission is over (if for some reason it had started)
 		transfer[node].currentfile = NULL;
 		filestosend--;

From 569af9f4c13b3124c7821689b612762d727274eb Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Fri, 26 May 2017 14:19:18 +0100
Subject: [PATCH 26/34] I am dumb, SV_AbortSendFiles already does what
 SV_RemoveFileSendList was made to do

---
 src/d_netfil.c | 47 +----------------------------------------------
 1 file changed, 1 insertion(+), 46 deletions(-)

diff --git a/src/d_netfil.c b/src/d_netfil.c
index 8704e05ce..84e16aa1d 100644
--- a/src/d_netfil.c
+++ b/src/d_netfil.c
@@ -64,7 +64,6 @@
 
 // Prototypes
 static boolean SV_SendFile(INT32 node, const char *filename, UINT8 fileid);
-static void SV_RemoveFileSendList(INT32 node);
 
 // Sender structure
 typedef struct filetx_s
@@ -319,7 +318,7 @@ boolean Got_RequestFilePak(INT32 node)
 		READSTRINGN(p, wad, MAX_WADPATH);
 		if (!SV_SendFile(node, wad, id))
 		{
-			SV_RemoveFileSendList(node);
+			SV_AbortSendFiles(node);
 			return false; // don't read the rest of the files
 		}
 	}
@@ -607,50 +606,6 @@ void SV_SendRam(INT32 node, void *data, size_t size, freemethod_t freemethod, UI
 	filestosend++;
 }
 
-/** Removes all file requests for a node
-  * This is needed only if a PT_REQUESTFILE's content gave you something that shouldn't be there
-  *
-  * \param node The destination
-  * \sa Got_RequestFilePak
-  *
-  */
-static void SV_RemoveFileSendList(INT32 node)
-{
-	filetx_t *p = transfer[node].txlist;
-
-	if (p == NULL)
-		return; // ...well, that was easy
-
-	while (p)
-	{
-		// Free the file request according to the freemethod parameter used with SV_SendFile/Ram
-		switch (p->ram)
-		{
-			case SF_FILE: // It's a file, close it and free its filename
-				if (cv_noticedownload.value)
-					CONS_Printf("Cancelling file transfer for node %d\n", node);
-				if (transfer[node].currentfile)
-					fclose(transfer[node].currentfile);
-				free(p->id.filename);
-				break;
-			case SF_Z_RAM: // It's a memory block allocated with Z_Alloc or the likes, use Z_Free
-				Z_Free(p->id.ram);
-				break;
-			case SF_RAM: // It's a memory block allocated with malloc, use free
-				free(p->id.ram);
-			case SF_NOFREERAM: // Nothing to free
-				break;
-		}
-		// Remove the file request from the list
-		transfer[node].txlist = p->next;
-		free(p);
-		p = transfer[node].txlist;
-		// Indicate that the transmission is over (if for some reason it had started)
-		transfer[node].currentfile = NULL;
-		filestosend--;
-	}
-}
-
 /** Stops sending a file for a node, and removes the file request from the list,
   * either because the file has been fully sent or because the node was disconnected
   *

From e09270276ef445a36dae97b147c023b345f63eed Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Fri, 26 May 2017 14:38:59 +0100
Subject: [PATCH 27/34] Display node's IP when printing the "sending file to
 node n" message, if noticedownload is turned on

---
 src/d_netfil.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/d_netfil.c b/src/d_netfil.c
index 84e16aa1d..2c463c0b5 100644
--- a/src/d_netfil.c
+++ b/src/d_netfil.c
@@ -495,7 +495,7 @@ static boolean SV_SendFile(INT32 node, const char *filename, UINT8 fileid)
 	char wadfilename[MAX_WADPATH];
 
 	if (cv_noticedownload.value)
-		CONS_Printf("Sending file \"%s\" to node %d\n", filename, node);
+		CONS_Printf("Sending file \"%s\" to node %d (%s)\n", filename, node, I_GetNodeAddress(node));
 
 	// Find the last file in the list and set a pointer to its "next" field
 	q = &transfer[node].txlist;

From ab5835cd3b325b748a1b514bd6a825264779b982 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Fri, 26 May 2017 15:26:00 +0100
Subject: [PATCH 28/34] Remove cruft from my initial days of fumbling with this
 branch

textcmd[0] for PT_NODETIMEOUT can't hold anything < 0 anyway, and you'd probably have to really try to get >= MAXNETNODES
---
 src/d_clisrv.c | 7 +------
 src/d_net.c    | 2 --
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 2fc895c23..89418dde2 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -4004,9 +4004,6 @@ FILESTAMP
 
 	while (HGetPacket())
 	{
-		if (doomcom->remotenode == -1) // ...this should have been ignored already
-			continue; // might come from PT_NODETIMEOUT somehow though
-
 		node = (SINT8)doomcom->remotenode;
 
 		if (netbuffer->packettype == PT_CLIENTJOIN && server)
@@ -4039,10 +4036,8 @@ FILESTAMP
 		if (netbuffer->packettype == PT_PLAYERINFO)
 			continue; // We do nothing with PLAYERINFO, that's for the MS browser.
 
-		if (node < 0 || node >= MAXNETNODES) // THIS SHOULDN'T EVEN BE POSSIBLE
-			; //CONS_Printf("Received packet from node %d!\n", (int)node);
 		// Packet received from someone already playing
-		else if (nodeingame[node])
+		if (nodeingame[node])
 			HandlePacketFromPlayer(node);
 		// Packet received from someone not playing
 		else
diff --git a/src/d_net.c b/src/d_net.c
index 68720f5ee..b6914f817 100644
--- a/src/d_net.c
+++ b/src/d_net.c
@@ -1133,8 +1133,6 @@ boolean HGetPacket(void)
 
 		rebound_tail = (rebound_tail+1) % MAXREBOUND;
 
-		if (doomcom->remotenode == -1) // wait hang on what?
-			return true; // there might still be packets from others though, so don't return false
 #ifdef DEBUGFILE
 		if (debugfile)
 			DebugPrintpacket("GETLOCAL");

From 4d1af86431b9b7d4f90b314811df7825ac467fe8 Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Fri, 26 May 2017 15:30:26 +0100
Subject: [PATCH 29/34] Cleanup part 2, make ye old 2.1.18 warning a debugfile
 only message, and make the node == -1 have its own debugfile only message too

Also get rid of a stray newline
---
 src/d_net.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/d_net.c b/src/d_net.c
index b6914f817..50b6c8cf6 100644
--- a/src/d_net.c
+++ b/src/d_net.c
@@ -713,7 +713,10 @@ void Net_CloseConnection(INT32 node)
 	boolean forceclose = (node & FORCECLOSE) != 0;
 
 	if (node == -1)
+	{
+		DEBFILE(M_GetText("Net_CloseConnection: node -1 detected!\n"));
 		return; // nope, just ignore it
+	}
 
 	node &= ~FORCECLOSE;
 
@@ -722,7 +725,7 @@ void Net_CloseConnection(INT32 node)
 
 	if (node < 0 || node >= MAXNETNODES) // prevent invalid nodes from crashing the game
 	{
-		//CONS_Alert(CONS_WARNING, M_GetText("Net_CloseConnection: invalid node %d detected!\n"), node);
+		DEBFILE(va(M_GetText("Net_CloseConnection: invalid node %d detected!\n"), node));
 		return;
 	}
 
@@ -1132,7 +1135,6 @@ boolean HGetPacket(void)
 			doomcom->remotenode = 0;
 
 		rebound_tail = (rebound_tail+1) % MAXREBOUND;
-
 #ifdef DEBUGFILE
 		if (debugfile)
 			DebugPrintpacket("GETLOCAL");

From db2f8a50bac82d604cf25fcadbb46a439f72256f Mon Sep 17 00:00:00 2001
From: toasterbabe <rollerorbital@gmail.com>
Date: Fri, 26 May 2017 16:16:10 +0100
Subject: [PATCH 30/34] Make sure that the number of files you're trying to add
 is properly considered!

---
 src/d_netfil.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/d_netfil.c b/src/d_netfil.c
index 479fd60de..70e9ce565 100644
--- a/src/d_netfil.c
+++ b/src/d_netfil.c
@@ -331,6 +331,7 @@ INT32 CL_CheckFiles(void)
 	char wadfilename[MAX_WADPATH];
 	INT32 ret = 1;
 	size_t packetsize = 0;
+	size_t filestoget = 0;
 	serverinfo_pak *dummycheck = NULL;
 
 	// Shut the compiler up.
@@ -408,10 +409,12 @@ INT32 CL_CheckFiles(void)
 
 		packetsize += nameonlylength(fileneeded[i].filename) + 22;
 
-		if ((numwadfiles >= MAX_WADFILES)
+		if ((numwadfiles+filestoget >= MAX_WADFILES)
 		|| (packetsize > sizeof(dummycheck->fileneeded)))
 			return 3;
 
+		filestoget++;
+
 		fileneeded[i].status = findfile(fileneeded[i].filename, fileneeded[i].md5sum, true);
 		CONS_Debug(DBG_NETPLAY, "found %d\n", fileneeded[i].status);
 		if (fileneeded[i].status != FS_FOUND)

From 86a76a9766c7807283f5a35a09ff7a2593d81211 Mon Sep 17 00:00:00 2001
From: Alam Ed Arias <alam@srb2.org>
Date: Fri, 26 May 2017 18:10:53 -0400
Subject: [PATCH 31/34] Makefile: disable GETTEXT by default

---
 src/Makefile     | 2 --
 src/Makefile.cfg | 9 ---------
 2 files changed, 11 deletions(-)

diff --git a/src/Makefile b/src/Makefile
index 76f013c52..426dc2289 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -511,13 +511,11 @@ OBJS:=$(i_main_o) \
 # For reference, this is the command I use to build a srb2.pot file from the source code.
 # (The listed source files are the ones containing translated strings).
 # FILES=""; for file in `find ./ | grep "\.c" | grep -v svn`; do [ "`grep "M_GetText(" $file`" ] && FILES="$FILES $file"; done; xgettext -d srb2 -o locale/srb2.pot -kM_GetText -F --no-wrap $FILES
-ifndef NOGETTEXT
 ifdef GETTEXT
 POS:=$(BIN)/en.mo
 
 OPTS+=-DGETTEXT
 endif
-endif
 
 ifdef DJGPPDOS
 all:	 pre-build $(BIN)/$(EXENAME)
diff --git a/src/Makefile.cfg b/src/Makefile.cfg
index 22546fbff..5bf7f247d 100644
--- a/src/Makefile.cfg
+++ b/src/Makefile.cfg
@@ -283,9 +283,6 @@ else
 ifdef LINUX
 	NASMFORMAT=elf -DLINUX
 	SDL=1
-ifndef NOGETTEXT
-	GETTEXT=1
-endif
 ifdef LINUX64
 	OBJDIR:=$(OBJDIR)/Linux64
 	BIN:=$(BIN)/Linux64
@@ -321,9 +318,6 @@ else
 ifdef MINGW64
 	INTERFACE=win32
 	#NASMFORMAT=win64
-ifndef NOGETTEXT
-	#GETTEXT=1
-endif
 	OBJDIR:=$(OBJDIR)/Mingw64
 	BIN:=$(BIN)/Mingw64
 else
@@ -354,9 +348,6 @@ else
 ifdef MINGW
 	INTERFACE=win32
 	NASMFORMAT=win32
-ifndef NOGETTEXT
-	#GETTEXT=1
-endif
 	OBJDIR:=$(OBJDIR)/Mingw
 	BIN:=$(BIN)/Mingw
 else

From 877e9510f7e0397814e28eb6630625bead5a9165 Mon Sep 17 00:00:00 2001
From: Alam Ed Arias <alam@srb2.org>
Date: Fri, 26 May 2017 21:38:49 -0400
Subject: [PATCH 32/34] Update version number to v2.1.19

---
 CMakeLists.txt                                     | 2 +-
 appveyor.yml                                       | 2 +-
 src/doomdef.h                                      | 8 ++++----
 src/sdl/macosx/Srb2mac.xcodeproj/project.pbxproj   | 4 ++--
 src/sdl12/macosx/Srb2mac.xcodeproj/project.pbxproj | 4 ++--
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 23b768a70..f9364fdd2 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,6 +1,6 @@
 cmake_minimum_required(VERSION 3.0)
 project(SRB2
-	VERSION 2.1.18
+	VERSION 2.1.19
 	LANGUAGES C)
 
 if(${PROJECT_SOURCE_DIR} MATCHES ${PROJECT_BINARY_DIR})
diff --git a/appveyor.yml b/appveyor.yml
index c1f6894ef..cc073ff01 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -1,4 +1,4 @@
-version: 2.1.18.{branch}-{build}
+version: 2.1.19.{branch}-{build}
 os: MinGW
 
 environment:
diff --git a/src/doomdef.h b/src/doomdef.h
index 428972ccd..cdb1a7dbf 100644
--- a/src/doomdef.h
+++ b/src/doomdef.h
@@ -150,9 +150,9 @@ extern FILE *logstream;
 // we use comprevision and compbranch instead.
 #else
 #define VERSION    201 // Game version
-#define SUBVERSION 18  // more precise version number
-#define VERSIONSTRING "v2.1.18"
-#define VERSIONSTRINGW L"v2.1.18"
+#define SUBVERSION 19  // more precise version number
+#define VERSIONSTRING "v2.1.19"
+#define VERSIONSTRINGW L"v2.1.19"
 // Hey! If you change this, add 1 to the MODVERSION below!
 // Otherwise we can't force updates!
 #endif
@@ -214,7 +214,7 @@ extern FILE *logstream;
 // it's only for detection of the version the player is using so the MS can alert them of an update.
 // Only set it higher, not lower, obviously.
 // Note that we use this to help keep internal testing in check; this is why v2.1.0 is not version "1".
-#define MODVERSION 23
+#define MODVERSION 24
 
 // =========================================================================
 
diff --git a/src/sdl/macosx/Srb2mac.xcodeproj/project.pbxproj b/src/sdl/macosx/Srb2mac.xcodeproj/project.pbxproj
index fbf9bacb2..68391f99c 100644
--- a/src/sdl/macosx/Srb2mac.xcodeproj/project.pbxproj
+++ b/src/sdl/macosx/Srb2mac.xcodeproj/project.pbxproj
@@ -1214,7 +1214,7 @@
 		C01FCF4B08A954540054247B /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				CURRENT_PROJECT_VERSION = 2.1.18;
+				CURRENT_PROJECT_VERSION = 2.1.19;
 				GCC_PREPROCESSOR_DEFINITIONS = (
 					"$(inherited)",
 					NORMALSRB2,
@@ -1226,7 +1226,7 @@
 		C01FCF4C08A954540054247B /* Release */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				CURRENT_PROJECT_VERSION = 2.1.18;
+				CURRENT_PROJECT_VERSION = 2.1.19;
 				GCC_ENABLE_FIX_AND_CONTINUE = NO;
 				GCC_GENERATE_DEBUGGING_SYMBOLS = NO;
 				GCC_PREPROCESSOR_DEFINITIONS = (
diff --git a/src/sdl12/macosx/Srb2mac.xcodeproj/project.pbxproj b/src/sdl12/macosx/Srb2mac.xcodeproj/project.pbxproj
index 98a760c7b..fada7849c 100644
--- a/src/sdl12/macosx/Srb2mac.xcodeproj/project.pbxproj
+++ b/src/sdl12/macosx/Srb2mac.xcodeproj/project.pbxproj
@@ -1214,7 +1214,7 @@
 		C01FCF4B08A954540054247B /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				CURRENT_PROJECT_VERSION = 2.1.18;
+				CURRENT_PROJECT_VERSION = 2.1.19;
 				GCC_PREPROCESSOR_DEFINITIONS = (
 					"$(inherited)",
 					NORMALSRB2,
@@ -1226,7 +1226,7 @@
 		C01FCF4C08A954540054247B /* Release */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				CURRENT_PROJECT_VERSION = 2.1.18;
+				CURRENT_PROJECT_VERSION = 2.1.19;
 				GCC_ENABLE_FIX_AND_CONTINUE = NO;
 				GCC_GENERATE_DEBUGGING_SYMBOLS = NO;
 				GCC_PREPROCESSOR_DEFINITIONS = (

From d20efa5a744ec046cce1e4df8a9fecb45e0c590f Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Sat, 27 May 2017 19:06:46 +0100
Subject: [PATCH 33/34] Entirely ignore PT_ASKINFOVIAMS packets, since it turns
 out it's not even sent by the MS anyway

---
 src/d_clisrv.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/d_clisrv.c b/src/d_clisrv.c
index 89418dde2..6adaae191 100644
--- a/src/d_clisrv.c
+++ b/src/d_clisrv.c
@@ -3413,6 +3413,7 @@ static void HandlePacketFromAwayNode(SINT8 node)
 	switch (netbuffer->packettype)
 	{
 		case PT_ASKINFOVIAMS:
+#if 0
 			if (server && serverrunning)
 			{
 				INT32 clientnode;
@@ -3434,6 +3435,9 @@ static void HandlePacketFromAwayNode(SINT8 node)
 			}
 			else
 				Net_CloseConnection(node); // you're not supposed to get it, so ignore it
+#else
+			Net_CloseConnection(node);
+#endif
 			break;
 
 		case PT_ASKINFO:

From c44a935b04cec66913f23e040f26bcc3e0739a04 Mon Sep 17 00:00:00 2001
From: Yukita Mayako <catgirl@goddess.moe>
Date: Sat, 27 May 2017 14:03:27 -0500
Subject: [PATCH 34/34] Rewrote `thinkers.iterate` to handle invalid pointers
 elegantly.

---
 src/lua_thinkerlib.c | 134 +++++++++++++++++++++++++++----------------
 1 file changed, 84 insertions(+), 50 deletions(-)

diff --git a/src/lua_thinkerlib.c b/src/lua_thinkerlib.c
index d5251425a..aaa8435e9 100644
--- a/src/lua_thinkerlib.c
+++ b/src/lua_thinkerlib.c
@@ -16,84 +16,118 @@
 #include "lua_script.h"
 #include "lua_libs.h"
 
+#define META_ITERATIONSTATE "iteration state"
+
 static const char *const iter_opt[] = {
 	"all",
 	"mobj",
 	NULL};
 
+static const actionf_p1 iter_funcs[] = {
+	NULL,
+	(actionf_p1)P_MobjThinker
+};
+
+struct iterationState {
+	actionf_p1 filter;
+	int next;
+};
+
+static int iterationState_gc(lua_State *L)
+{
+	struct iterationState *it = luaL_checkudata(L, -1, META_ITERATIONSTATE);
+	if (it->next != LUA_REFNIL)
+	{
+		luaL_unref(L, LUA_REGISTRYINDEX, it->next);
+		it->next = LUA_REFNIL;
+	}
+	return 0;
+}
+
+#define push_thinker(th) {\
+	if ((th)->function.acp1 == (actionf_p1)P_MobjThinker) \
+		LUA_PushUserdata(L, (th), META_MOBJ); \
+	else \
+		lua_pushlightuserdata(L, (th)); \
+}
+
 static int lib_iterateThinkers(lua_State *L)
 {
-	int state = luaL_checkoption(L, 1, "mobj", iter_opt);
-
-	thinker_t *th = NULL;
-	actionf_p1 searchFunc;
-	const char *searchMeta;
-
+	thinker_t *th = NULL, *next = NULL;
+	struct iterationState *it = luaL_checkudata(L, 1, META_ITERATIONSTATE);
 	lua_settop(L, 2);
-	lua_remove(L, 1); // remove state now.
 
-	switch(state)
+	if (lua_isnil(L, 2))
+		th = &thinkercap;
+	else if (lua_isuserdata(L, 2))
 	{
-		case 0:
-			searchFunc = NULL;
-			searchMeta = NULL;
-			break;
-		case 1:
-		default:
-			searchFunc = (actionf_p1)P_MobjThinker;
-			searchMeta = META_MOBJ;
-			break;
+		if (lua_islightuserdata(L, 2))
+			th = lua_touserdata(L, 2);
+		else
+		{
+			th = *(thinker_t **)lua_touserdata(L, -1);
+			if (!th)
+			{
+				if (it->next == LUA_REFNIL)
+					return 0;
+
+				lua_rawgeti(L, LUA_REGISTRYINDEX, it->next);
+				if (lua_islightuserdata(L, -1))
+					next = lua_touserdata(L, -1);
+				else
+					next = *(thinker_t **)lua_touserdata(L, -1);
+			}
+		}
 	}
 
-	if (!lua_isnil(L, 1)) {
-		if (lua_islightuserdata(L, 1))
-			th = (thinker_t *)lua_touserdata(L, 1);
-		else if (searchMeta)
-			th = *((thinker_t **)luaL_checkudata(L, 1, searchMeta));
-		else
-			th = *((thinker_t **)lua_touserdata(L, 1));
-	} else
-		th = &thinkercap;
+	luaL_unref(L, LUA_REGISTRYINDEX, it->next);
+	it->next = LUA_REFNIL;
 
-	if (!th) // something got our userdata invalidated!
-		return 0;
+	if (th && !next)
+		next = th->next;
+	if (!next)
+		return luaL_error(L, "next thinker invalidated during iteration");
 
-	if (searchFunc == NULL)
-	{
-		if ((th = th->next) != &thinkercap)
+	for (; next != &thinkercap; next = next->next)
+		if (!it->filter || next->function.acp1 == it->filter)
 		{
-			if (th->function.acp1 == (actionf_p1)P_MobjThinker)
-				LUA_PushUserdata(L, th, META_MOBJ);
-			else
-				lua_pushlightuserdata(L, th);
+			push_thinker(next);
+			if (next->next != &thinkercap)
+			{
+				push_thinker(next->next);
+				it->next = luaL_ref(L, LUA_REGISTRYINDEX);
+			}
 			return 1;
 		}
-		return 0;
-	}
-
-	for (th = th->next; th != &thinkercap; th = th->next)
-	{
-		if (th->function.acp1 != searchFunc)
-			continue;
-
-		LUA_PushUserdata(L, th, searchMeta);
-		return 1;
-	}
 	return 0;
 }
 
 static int lib_startIterate(lua_State *L)
 {
-	luaL_checkoption(L, 1, iter_opt[0], iter_opt);
-	lua_pushcfunction(L, lib_iterateThinkers);
-	lua_pushvalue(L, 1);
+	struct iterationState *it;
+
+	lua_pushvalue(L, lua_upvalueindex(1));
+	it = lua_newuserdata(L, sizeof(struct iterationState));
+	luaL_getmetatable(L, META_ITERATIONSTATE);
+	lua_setmetatable(L, -2);
+
+	it->filter = iter_funcs[luaL_checkoption(L, 1, "mobj", iter_opt)];
+	it->next = LUA_REFNIL;
 	return 2;
 }
 
+#undef push_thinker
+
 int LUA_ThinkerLib(lua_State *L)
 {
+	luaL_newmetatable(L, META_ITERATIONSTATE);
+	lua_pushcfunction(L, iterationState_gc);
+	lua_setfield(L, -2, "__gc");
+	lua_pop(L, 1);
+
 	lua_createtable(L, 0, 1);
-		lua_pushcfunction(L, lib_startIterate);
+		lua_pushcfunction(L, lib_iterateThinkers);
+		lua_pushcclosure(L, lib_startIterate, 1);
 		lua_setfield(L, -2, "iterate");
 	lua_setglobal(L, "thinkers");
 	return 0;