Index: code/win32/win_main.c
===================================================================
--- code/win32/win_main.c	(revision 7)
+++ code/win32/win_main.c	(revision 37)
@@ -1191,6 +1191,10 @@
         return 0;
 	}
 
+	// Cgg - max number of open files at the crt level
+	_setmaxstdio(2048);
+	// !Cgg
+
 	g_wv.hInstance = hInstance;
 	Q_strncpyz( sys_cmdline, lpCmdLine, sizeof( sys_cmdline ) );
 
Index: code/server/sv_init.c
===================================================================
--- code/server/sv_init.c	(revision 7)
+++ code/server/sv_init.c	(revision 37)
@@ -520,12 +520,17 @@
 		Cvar_Set( "sv_paks", "" );
 		Cvar_Set( "sv_pakNames", "" );
 	}
+// Cgg - this fails with the large number of defrag pk3s
+// Removing this prevents packs from being auto-downloaded, but so does repacking.
+/*
 	// the server sends these to the clients so they can figure
 	// out which pk3s should be auto-downloaded
 	p = FS_ReferencedPakChecksums();
 	Cvar_Set( "sv_referencedPaks", p );
 	p = FS_ReferencedPakNames();
 	Cvar_Set( "sv_referencedPakNames", p );
+*/
+// !Cgg
 
 	// save systeminfo and serverinfo strings
 	Q_strncpyz( systemInfo, Cvar_InfoString_Big( CVAR_SYSTEMINFO ), sizeof( systemInfo ) );
Index: code/game/q_shared.h
===================================================================
--- code/game/q_shared.h	(revision 7)
+++ code/game/q_shared.h	(revision 37)
@@ -26,7 +26,7 @@
 // q_shared.h -- included first by ALL program modules.
 // A user mod should never modify this file
 
-#define	Q3_VERSION		"Q3 1.32b"
+#define	Q3_VERSION		"dfengine 1.01"
 // 1.32 released 7-10-2002
 
 #define MAX_TEAMNAME 32
Index: code/qcommon/files.c
===================================================================
--- code/qcommon/files.c	(revision 7)
+++ code/qcommon/files.c	(revision 37)
@@ -1705,6 +1705,10 @@
 	{
 		err = unzGetCurrentFileInfo(uf, &file_info, filename_inzip, sizeof(filename_inzip), NULL, 0, NULL, 0);
 		if (err != UNZ_OK) {
+			// Cgg - it's better to fail and have the user notified than to have a half-loaded pk3,
+			// or worse a failed pack referenced that results in further failures (yes it does happen)
+			Com_Error(ERR_FATAL, "Corrupted pk3 file \'%s\'", basename);
+			// !Cgg
 			break;
 		}
 		len += strlen(filename_inzip) + 1;
@@ -1746,6 +1750,9 @@
 	{
 		err = unzGetCurrentFileInfo(uf, &file_info, filename_inzip, sizeof(filename_inzip), NULL, 0, NULL, 0);
 		if (err != UNZ_OK) {
+			// Cgg - see above
+			Com_Error(ERR_FATAL, "Corrupted pk3 file \'%s\'", basename);
+			// !Cgg
 			break;
 		}
 		if (file_info.uncompressed_size > 0) {
@@ -2436,6 +2443,99 @@
 	}
 }
 
+// Cgg - autocompletion on map & demo names
+void Maps_CommandCompletion(void (*callback) (const char *s)) {
+	char **matches;
+	char m[MAX_QPATH];
+	char *c;
+	int i, n;
+
+	matches = FS_ListFilteredFiles("maps", ".bsp", NULL, &n);
+	FS_SortFileList(matches, n);
+	for (i=0; i<n; i++) {
+		Q_strncpyz(m, matches[i], sizeof(m));
+		for (c=m+strlen(m)-1; c>m; c--) {
+			if (*c != '.') {
+				continue;
+			}
+			*c = 0;
+			break;
+		}
+		callback(m);
+	}
+	FS_FreeFileList(matches);
+}
+const char *Field_GetCompletionString();	// prototype from common.c
+void Demos_CommandCompletion(void (*callback) (const char *s)) {
+	char searchpath[MAX_QPATH];
+	char path[MAX_QPATH];
+	char m[MAX_QPATH];
+	char **matches;
+	char **list;
+	const char *completionString, *c;
+	int i, n, nlist;
+
+	// set up searchpath
+	Q_strncpyz(path, "", sizeof(path));
+	Q_strncpyz(searchpath, "demos", sizeof(searchpath));
+	completionString = Field_GetCompletionString();
+	for (c=completionString+strlen(completionString)-1; c>completionString; c--) {
+		if (*c == '/') {
+			Q_strncpyz(path, completionString, c-completionString+1);	// destsize accounts for the trailing \0
+			Com_sprintf(searchpath, sizeof(searchpath), "demos/%s", path);
+			break;
+		}
+	}
+
+	// set up the list
+	list = Z_Malloc(MAX_FOUND_FILES * sizeof(*list));
+	nlist = 0;
+
+	// directories
+	matches = FS_ListFilteredFiles(searchpath, "/", NULL, &n);
+	for (i=0; i<n; i++) {
+		// filter out . .. and hidden files that follow the unix convention
+		if (matches[i][0] == '.') {
+			continue;
+		}
+		// FS_ListFilteredFiles() on directories returns one empty string
+		if (matches[i][0] == 0) {
+			continue;
+		}
+		if (strlen(path)) {
+			Com_sprintf(m, sizeof(m), "%s/%s/", path, matches[i]);
+		} else {
+			Com_sprintf(m, sizeof(m), "%s/", matches[i]);
+		}
+		nlist = FS_AddFileToList(m, list, nlist);
+	}
+	FS_FreeFileList(matches);
+
+	// demos
+	matches = FS_ListFilteredFiles(searchpath, ".dm_6?", NULL, &n);
+	for (i=0; i<n; i++) {
+		// filter hidden files out
+		if (matches[i][0] == '.') {
+			continue;
+		}
+		if (strlen(path)) {
+			Com_sprintf(m, sizeof(m), "%s/%s", path, matches[i]);
+			nlist = FS_AddFileToList(m, list, nlist);
+			continue;
+		}
+		nlist = FS_AddFileToList(matches[i], list, nlist);
+	}
+	FS_FreeFileList(matches);
+
+	// sort list and callback
+	FS_SortFileList(list, nlist);
+	for (i=0; i<nlist; i++) {
+		callback(list[i]);
+	}
+	FS_FreeFileList(list);
+}
+// !Cgg
+
 //===========================================================================
 
 
Index: code/qcommon/cmd.c
===================================================================
--- code/qcommon/cmd.c	(revision 7)
+++ code/qcommon/cmd.c	(revision 37)
@@ -240,6 +240,11 @@
 	char	*f;
 	int		len;
 	char	filename[MAX_QPATH];
+	// Cgg
+	char	cmd[MAX_CMD_LINE];
+	char	*c, *s;
+	int		quotes, l;
+	// !Cgg
 
 	if (Cmd_Argc () != 2) {
 		Com_Printf ("exec <filename> : execute a script file\n");
@@ -254,9 +259,31 @@
 		return;
 	}
 	Com_Printf ("execing %s\n",Cmd_Argv(1));
-	
-	Cbuf_InsertText (f);
 
+	// Cgg - parse and execute the file buffer immediately
+	c=f; s=c; quotes=0;
+	do {
+		if (*c == '"') {
+			quotes++;
+			continue;
+		}
+		if (*c == 0 || *c == ';' && !(quotes&1) || *c == '\r' || *c == '\n') {
+			if (s != c) {
+				// l accounts for the trailing \0
+				l = (c-s +1 < MAX_CMD_LINE) ? c-s +1 : MAX_CMD_LINE;
+				// skip wait commands since we no longer use the command buffer
+				if (Q_stricmpn(s, "wait", 4)) {
+					Q_strncpyz(cmd, s, l);
+					Cmd_ExecuteString(cmd);
+				}
+			}
+			while (*c == '\r' || *c == '\n' || *c == ';' || *c == ' ' || *c == '\t') c++;
+			s=c; quotes=0;
+		}
+	} while (*c++);
+	//was: Cbuf_InsertText (f);
+	// !Cgg
+
 	FS_FreeFile (f);
 }
 
Index: code/qcommon/qcommon.h
===================================================================
--- code/qcommon/qcommon.h	(revision 7)
+++ code/qcommon/qcommon.h	(revision 37)
@@ -632,6 +632,11 @@
 
 void FS_Rename( const char *from, const char *to );
 
+// Cgg - autocompletion on map & demo names
+void Maps_CommandCompletion(void (*callback) (const char *s));
+void Demos_CommandCompletion(void (*callback) (const char *s));
+// !Cgg
+
 /*
 ==============================================================
 
Index: code/qcommon/common.c
===================================================================
--- code/qcommon/common.c	(revision 7)
+++ code/qcommon/common.c	(revision 37)
@@ -3184,6 +3184,12 @@
 // field we are working on, passed to Field_CompleteCommand (&g_consoleCommand for instance)
 static field_t *completionField;
 
+// Cgg
+const char *Field_GetCompletionString() {
+	return completionString;
+}
+// !Cgg
+
 /*
 ===============
 FindMatches
@@ -3203,11 +3209,14 @@
 	}
 
 	// cut shortestMatch to the amount common with s
-	for ( i = 0 ; s[i] ; i++ ) {
+	// Cgg - was wrong when s had fewer chars than shortestMatch
+	i = 0;
+	do {
 		if ( tolower(shortestMatch[i]) != tolower(s[i]) ) {
 			shortestMatch[i] = 0;
 		}
-	}
+	} while (s[i++]);
+	// !Cgg
 }
 
 /*
@@ -3293,6 +3302,51 @@
 		return;
 	}
 
+	// Cgg - autocompletion on map names
+	if (!Q_stricmp(completionString, "map")
+		|| !Q_stricmp(completionString, "devmap")
+		|| !Q_stricmp(completionString, "vq3")
+		|| !Q_stricmp(completionString, "devvq3")
+		|| !Q_stricmp(completionString, "cpm")
+		|| !Q_stricmp(completionString, "devcpm")) {
+		const char *cmd;
+		cmd = Q_strlwr(Cmd_Argv(0));
+		completionString = Cmd_Argv(1);
+		if ( cmd[0] == '\\' || cmd[0] == '/' ) {
+			cmd++;
+		}
+		Maps_CommandCompletion(FindMatches);
+		Com_sprintf(completionField->buffer, sizeof(completionField->buffer), "\\%s %s", cmd, (shortestMatch[0]) ? shortestMatch : Cmd_Argv(1));
+		completionField->cursor = strlen(completionField->buffer);
+		if (matchCount < 2) {
+			return;
+		}
+		Com_Printf( "]%s\n", completionField->buffer );
+		Maps_CommandCompletion(PrintMatches);
+		return;
+	}
+	// !Cgg
+
+	// Cgg - autocompletion on demo names
+	if (!Q_stricmp(completionString, "demo")) {
+		const char *cmd;
+		cmd = Q_strlwr(Cmd_Argv(0));
+		completionString = Cmd_Argv(1);
+		if ( cmd[0] == '\\' || cmd[0] == '/' ) {
+			cmd++;
+		}
+		Demos_CommandCompletion(FindMatches);
+		Com_sprintf(completionField->buffer, sizeof(completionField->buffer), "\\%s %s", cmd, (shortestMatch[0]) ? shortestMatch : Cmd_Argv(1));
+		completionField->cursor = strlen(completionField->buffer);
+		if (matchCount < 2) {
+			return;
+		}
+		Com_Printf( "]%s\n", completionField->buffer );
+		Demos_CommandCompletion(PrintMatches);
+		return;
+	}
+	// !Cgg
+
 	Cmd_CommandCompletion( FindMatches );
 	Cvar_CommandCompletion( FindMatches );
 
Index: code/client/cl_main.c
===================================================================
--- code/client/cl_main.c	(revision 7)
+++ code/client/cl_main.c	(revision 37)
@@ -279,11 +279,11 @@
 		Com_Printf ("You must be in a level to record.\n");
 		return;
 	}
-
-  // sync 0 doesn't prevent recording, so not forcing it off .. everyone does g_sync 1 ; record ; g_sync 0 ..
+/* Cgg
+	// sync 0 doesn't prevent recording, so not forcing it off .. everyone does g_sync 1 ; record ; g_sync 0 ..
 	if ( !Cvar_VariableValue( "g_synchronousClients" ) ) {
 		Com_Printf (S_COLOR_YELLOW "WARNING: You should set 'g_synchronousClients 1' for smoother demo recording\n");
-	}
+	}*/
 
 	if ( Cmd_Argc() == 2 ) {
 		s = Cmd_Argv(1);
Index: code/client/cl_scrn.c
===================================================================
--- code/client/cl_scrn.c	(revision 7)
+++ code/client/cl_scrn.c	(revision 37)
@@ -30,6 +30,7 @@
 cvar_t		*cl_graphheight;
 cvar_t		*cl_graphscale;
 cvar_t		*cl_graphshift;
+cvar_t		*ch_recordMessage;	// Cgg
 
 /*
 ================
@@ -329,6 +330,12 @@
 	char	string[1024];
 	int		pos;
 
+	// Cgg - off by default
+	if (!ch_recordMessage->integer) {
+		return;
+	}
+	// !Cgg
+
 	if ( !clc.demorecording ) {
 		return;
 	}
@@ -421,6 +428,7 @@
 	cl_graphheight = Cvar_Get ("graphheight", "32", CVAR_CHEAT);
 	cl_graphscale = Cvar_Get ("graphscale", "1", CVAR_CHEAT);
 	cl_graphshift = Cvar_Get ("graphshift", "0", CVAR_CHEAT);
+	ch_recordMessage = Cvar_Get ("ch_recordMessage", "0", CVAR_ARCHIVE);	// Cgg
 
 	scr_initialized = qtrue;
 }
Index: code/client/cl_parse.c
===================================================================
--- code/client/cl_parse.c	(revision 7)
+++ code/client/cl_parse.c	(revision 37)
@@ -255,6 +255,16 @@
 
 	// read areamask
 	len = MSG_ReadByte( msg );
+	// Cgg - ioquake3 rev 796
+	// Fix remotely exploitable parse download overflow reported by Luigi Auriemma.
+	// See http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046578.html
+	// for the advisory.
+	if(len > sizeof(newSnap.areamask))
+	{
+		Com_Error (ERR_DROP,"CL_ParseSnapshot: Invalid size %d for areamask.", len);
+		return;
+	}
+	// !Cgg
 	MSG_ReadData( msg, &newSnap.areamask, len);
 
 	// read playerinfo
@@ -475,6 +485,17 @@
 	unsigned char data[MAX_MSGLEN];
 	int block;
 
+	// Cgg - ioquake3 rev 796
+	// Fix remotely exploitable parse download overflow reported by Luigi Auriemma.
+	// See http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046578.html
+	// for the advisory.
+	if (!*clc.downloadTempName) {
+		Com_Printf("Server sending download, but no download was requested\n");
+		CL_AddReliableCommand( "stopdl" );
+		return;
+	}
+	// !Cgg
+
 	// read the data
 	block = MSG_ReadShort ( msg );
 
@@ -493,8 +514,17 @@
 	}
 
 	size = MSG_ReadShort ( msg );
-	if (size > 0)
-		MSG_ReadData( msg, data, size );
+	// Cgg - ioquake3 rev 796
+	// Fix remotely exploitable parse download overflow reported by Luigi Auriemma.
+	// See http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046578.html
+	// for the advisory.
+	if (size < 0 || size > sizeof(data))
+	{
+		Com_Error(ERR_DROP, "CL_ParseDownload: Invalid size %d for download chunk.", size);
+		return;
+	}
+	MSG_ReadData(msg, data, size);	
+	// !Cgg
 
 	if (clc.downloadBlock != block) {
 		Com_DPrintf( "CL_ParseDownload: Expected block %d, got %d\n", clc.downloadBlock, block);
@@ -504,11 +534,17 @@
 	// open the file if not opened yet
 	if (!clc.download)
 	{
+		// Cgg - ioquake3 rev 796
+		// Fix remotely exploitable parse download overflow reported by Luigi Auriemma.
+		// See http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046578.html
+		// for the advisory.
+	/*
 		if (!*clc.downloadTempName) {
 			Com_Printf("Server sending download, but no download was requested\n");
 			CL_AddReliableCommand( "stopdl" );
 			return;
-		}
+		}*/
+		// !Cgg
 
 		clc.download = FS_SV_FOpenFileWrite( clc.downloadTempName );
 
Index: code/client/cl_keys.c
===================================================================
--- code/client/cl_keys.c	(revision 7)
+++ code/client/cl_keys.c	(revision 37)
@@ -1205,7 +1205,8 @@
 */
 void CL_CharEvent( int key ) {
 	// the console key should never be used as a char
-	if ( key == '`' || key == '~' ) {
+	if ( key == '`' || key == '~' 
+		|| key == 178 ) {	// Cgg - azerty french keyboard layout
 		return;
 	}
 
