r813 - trunk/code/cgame

[DONOTREPLY at icculus.org]

Author: thilo
Date: 2006-07-05 20:37:56 -0400 (Wed, 05 Jul 2006)
New Revision: 813

Modified:
   trunk/code/cgame/cg_main.c
Log:
Fix critical buffer overflow in cgame, see exploit at http://www.milw0rm.com/exploits/1977


Modified: trunk/code/cgame/cg_main.c
===================================================================
--- trunk/code/cgame/cg_main.c	2006-07-05 20:30:53 UTC (rev 812)
+++ trunk/code/cgame/cg_main.c	2006-07-06 00:37:56 UTC (rev 813)
@@ -703,7 +703,7 @@
 	}
 
 	// only register the items that the server says we need
-	strcpy( items, CG_ConfigString( CS_ITEMS ) );
+	Q_strncpyz(items, CG_ConfigString(CS_ITEMS), sizeof(items));
 
 	for ( i = 1 ; i < bg_numItems ; i++ ) {
 //		if ( items[ i ] == '1' || cg_buildScript.integer ) {
@@ -1016,7 +1016,7 @@
 	memset( cg_weapons, 0, sizeof( cg_weapons ) );
 
 	// only register the items that the server says we need
-	strcpy( items, CG_ConfigString( CS_ITEMS) );
+	Q_strncpyz(items, CG_ConfigString(CS_ITEMS), sizeof(items));
 
 	for ( i = 1 ; i < bg_numItems ; i++ ) {
 		if ( items[ i ] == '1' || cg_buildScript.integer ) {