Global def_to_ddef (def_t *def, ddef_t *ddef, int aux): The def is not verified to be a field def when aux is true.
Global parse_float (const char *str): No error checking is performed.
Global parse_vector (const char *str, vec3_t vec): No error checking is performed.
Global QFS_FilelistFill (filelist_t *list, const char *path, const char *ext, int strip): can escape the quake file system
Global temp_def (etype_t type, int size): size is not checked for validity (must be 1-4).
Global UDP_GetNameFromAddr (netadr_t *addr, char *name): No checking is done on the size of the buffer, and uses strcpy.