From ff387993817bded08896add2e6aca306fc4cc184 Mon Sep 17 00:00:00 2001 From: Artem Kharytoniuk Date: Wed, 10 May 2017 19:58:42 +0300 Subject: [PATCH] CL_DemoFilename : Fixed crash due to buffer overflow bug. fileName arg points to a buffer of size MAX_QPATH. Original code used MAX_OSPATH instead. --- src/engine/client/cl_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/engine/client/cl_main.c b/src/engine/client/cl_main.c index 4b7839a..9a22069 100644 --- a/src/engine/client/cl_main.c +++ b/src/engine/client/cl_main.c @@ -227,7 +227,7 @@ void CL_DemoFilename( int number, char *fileName ) { int a,b,c,d; if ( number < 0 || number > 9999 ) { - Com_sprintf( fileName, MAX_OSPATH, "demo9999.tga" ); + Com_sprintf( fileName, MAX_QPATH, "demo9999.tga" ); return; } @@ -239,7 +239,7 @@ void CL_DemoFilename( int number, char *fileName ) { number -= c*10; d = number; - Com_sprintf( fileName, MAX_OSPATH, "demo%i%i%i%i" + Com_sprintf( fileName, MAX_QPATH, "demo%i%i%i%i" , a, b, c, d ); }