Code execution via unchecked map element counts

Buffer overflows in Ken Silverman Build Engine 1 allow attackers to execute arbitrary code by supplying a crafted map file. The ENGINE.C map loader reads numsectors from the file and passes the unchecked count to kread, which copies sector records into the fixed-size sector array; similar unchecked counts govern wall and sprite copies. A user must load the malicious map, after which attacker-controlled memory corruption can execute code with the privileges of the host process.