From 4a635232c834a08921e05d0042498d4a2d1a1fe6 Mon Sep 17 00:00:00 2001
From: thilo <thilo@edf5b092-35ff-0310-97b2-ce42778d08ea>
Date: Mon, 3 Jul 2006 21:37:50 +0000
Subject: - Fix arbitrary cvar overwrite flaw:
 http://aluigi.altervista.org/adv.htm - Add myself to maintainer list :)

git-svn-id: svn://svn.icculus.org/quake3/trunk@811 edf5b092-35ff-0310-97b2-ce42778d08ea
---
 code/client/cl_parse.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

(limited to 'code/client')

diff --git a/code/client/cl_parse.c b/code/client/cl_parse.c
index 81bdf5c..b12105b 100644
--- a/code/client/cl_parse.c
+++ b/code/client/cl_parse.c
@@ -368,16 +368,35 @@ void CL_SystemInfoChanged( void ) {
 	// scan through all the variables in the systeminfo and locally set cvars to match
 	s = systemInfo;
 	while ( s ) {
+		int cvar_flags;
+		
 		Info_NextPair( &s, key, value );
 		if ( !key[0] ) {
 			break;
 		}
+		
 		// ehw!
-		if ( !Q_stricmp( key, "fs_game" ) ) {
+		if (!Q_stricmp(key, "fs_game"))
+		{
+			if(FS_CheckDirTraversal(value))
+			{
+				Com_Printf("WARNING: Server sent invalid fs_game value %s\n", value);
+				continue;
+			}
+				
 			gameSet = qtrue;
 		}
 
-		Cvar_Set( key, value );
+		if((cvar_flags = Cvar_Flags(key)) == CVAR_NONEXISTENT)
+			Cvar_Get(key, value, CVAR_SERVER_CREATED | CVAR_ROM);
+		else
+		{
+			// If this cvar may not be modified by a server discard the value.
+			if(!(cvar_flags & (CVAR_SYSTEMINFO | CVAR_SERVER_CREATED)))
+				continue;
+
+			Cvar_Set(key, value);
+		}
 	}
 	// if game folder should not be set and it is set at the client side
 	if ( !gameSet && *Cvar_VariableString("fs_game") ) {
-- 
cgit v1.2.3