From a679ae64e0a659e2b94ec97e688633bc1a0d041e Mon Sep 17 00:00:00 2001 From: thilo Date: Sat, 6 May 2006 01:56:24 +0000 Subject: Add string length checking to function COM_StripExtension. This fixes the R_RemapShader buffer overflow exploit that can be found here: http://milw0rm.com/exploits/1750 git-svn-id: svn://svn.icculus.org/quake3/trunk@765 edf5b092-35ff-0310-97b2-ce42778d08ea --- code/q3_ui/ui_playermodel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'code/q3_ui/ui_playermodel.c') diff --git a/code/q3_ui/ui_playermodel.c b/code/q3_ui/ui_playermodel.c index 009f77d..e247149 100644 --- a/code/q3_ui/ui_playermodel.c +++ b/code/q3_ui/ui_playermodel.c @@ -391,7 +391,7 @@ static void PlayerModel_BuildList( void ) int numfiles; char dirlist[2048]; char filelist[2048]; - char skinname[64]; + char skinname[MAX_QPATH]; char* dirptr; char* fileptr; int i; @@ -424,7 +424,7 @@ static void PlayerModel_BuildList( void ) { filelen = strlen(fileptr); - COM_StripExtension(fileptr,skinname); + COM_StripExtension(fileptr,skinname, sizeof(skinname)); // look for icon_???? if (!Q_stricmpn(skinname,"icon_",5)) -- cgit v1.2.3