Fix startup crash: use ClientCmd for fullbright; sanitize owner netvars

- Poking VEngineCvar004/ConVar vtables directly crashed before the main menu
  (ConVar uses a secondary IConVar vtable). Use the stable IVEngineClient
  ClientCmd slot 7 for mat_fullbright instead.
- Reject out-of-range m_hOwnerEntity/m_hOwner offsets: the resolver found a
  bogus negative owner offset (-136296061), which could make item-ESP weapon
  ownership read wild memory.

1 files changed, 6 insertions, 2 deletions

diff --git a/src/netvars.cpp b/src/netvars.cpp
index adb5a6a..834aa2f 100644
--- a/src/netvars.cpp
+++ b/src/netvars.cpp
@@ -93,9 +93,13 @@ static void collect_netvars(uintptr_t table, uintptr_t base_off, int depth) {
                g_net.activeweapon < 0) {
       g_net.activeweapon = (int)(base_off + (uint32_t)poff);
     } else if (strcmp(pname2, "m_hOwnerEntity") == 0 && g_net.owner < 0) {
-      g_net.owner = (int)(base_off + (uint32_t)poff);
+      int off = (int)(base_off + (uint32_t)poff);
+      if (off > 0 && off < 0x2000)
+        g_net.owner = off;
     } else if (strcmp(pname2, "m_hOwner") == 0 && g_net.weapon_owner < 0) {
-      g_net.weapon_owner = (int)(base_off + (uint32_t)poff);
+      int off = (int)(base_off + (uint32_t)poff);
+      if (off > 0 && off < 0x2000)
+        g_net.weapon_owner = off;
     } else if (strcmp(pname2, "m_iTeamNum") == 0 && g_net.teamnum < 0) {
       g_net.teamnum = (int)(base_off + (uint32_t)poff);
     } else if (strcmp(pname2, "m_vecOrigin") == 0 && g_net.origin < 0) {