Improve bounds checks in MD3Importer::ValidateSurfaceHeaderOffsets to prevent pcSurf from accessing data outside the MD3 buffer (fixes #6070, CVE-2025-3549). Signed-off-by: mapengyuan <mapengyuan@xfusion.com> Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>