diff options
| author | thilo <thilo@edf5b092-35ff-0310-97b2-ce42778d08ea> | 2006-05-06 01:56:24 +0000 |
|---|---|---|
| committer | thilo <thilo@edf5b092-35ff-0310-97b2-ce42778d08ea> | 2006-05-06 01:56:24 +0000 |
| commit | a679ae64e0a659e2b94ec97e688633bc1a0d041e (patch) | |
| tree | 5d3fe1a56ea961fb5618cfda1fbd6d0072f44a4a /code/ui/ui_players.c | |
| parent | 29ce2df227e4c556707ae482d4391c7eb700121d (diff) | |
| download | ioquake3-aero-a679ae64e0a659e2b94ec97e688633bc1a0d041e.tar.gz ioquake3-aero-a679ae64e0a659e2b94ec97e688633bc1a0d041e.zip | |
Add string length checking to function COM_StripExtension. This fixes the R_RemapShader buffer overflow exploit that can be found here:
http://milw0rm.com/exploits/1750
git-svn-id: svn://svn.icculus.org/quake3/trunk@765 edf5b092-35ff-0310-97b2-ce42778d08ea
Diffstat (limited to 'code/ui/ui_players.c')
| -rw-r--r-- | code/ui/ui_players.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/code/ui/ui_players.c b/code/ui/ui_players.c index c164327..b09fb32 100644 --- a/code/ui/ui_players.c +++ b/code/ui/ui_players.c @@ -90,13 +90,13 @@ tryagain: if ( weaponNum == WP_MACHINEGUN || weaponNum == WP_GAUNTLET || weaponNum == WP_BFG ) { strcpy( path, item->world_model[0] ); - COM_StripExtension( path, path ); + COM_StripExtension(path, path, sizeof(path)); strcat( path, "_barrel.md3" ); pi->barrelModel = trap_R_RegisterModel( path ); } strcpy( path, item->world_model[0] ); - COM_StripExtension( path, path ); + COM_StripExtension(path, path, sizeof(path)); strcat( path, "_flash.md3" ); pi->flashModel = trap_R_RegisterModel( path ); |