From 551c5531d59e9561f6a49e85b63ab07a6087c30c Mon Sep 17 00:00:00 2001
From: toaster <rollerorbital@gmail.com>
Date: Thu, 22 Sep 2022 17:34:02 +0100
Subject: [PATCH] Enforce maximum length of 63 for map lumpname

Also, in g_demo.c, use SKIPSTRING (instead of READSTRINGN into a discard buffer)
---
 src/doomstat.h |  4 ++--
 src/g_demo.c   | 14 ++++++--------
 src/g_game.c   |  2 +-
 3 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/src/doomstat.h b/src/doomstat.h
index 7c5c0b15b..231d8ef81 100644
--- a/src/doomstat.h
+++ b/src/doomstat.h
@@ -373,6 +373,8 @@ struct cupheader_t
 extern cupheader_t *kartcupheaders; // Start of cup linked list
 extern UINT16 numkartcupheaders;
 
+#define MAXMAPLUMPNAME 64 // includes \0, for cleaner savedata
+
 /** Map header information.
   */
 struct mapheader_t
@@ -467,8 +469,6 @@ struct mapheader_t
 extern mapheader_t** mapheaderinfo;
 extern INT32 nummapheaders, mapallocsize;
 
-#define MAXMAPLUMPNAME 64 // includes \0, for cleaner savedata
-
 // Gametypes
 #define NUMGAMETYPEFREESLOTS 128
 
diff --git a/src/g_demo.c b/src/g_demo.c
index 1a56a66c1..8795b7123 100644
--- a/src/g_demo.c
+++ b/src/g_demo.c
@@ -2079,7 +2079,7 @@ void G_BeginRecording(void)
 
 	// game data
 	M_Memcpy(demobuf.p, "PLAY", 4); demobuf.p += 4;
-	WRITESTRINGN(demobuf.p, mapheaderinfo[gamemap-1]->lumpname, 255);
+	WRITESTRINGN(demobuf.p, mapheaderinfo[gamemap-1]->lumpname, MAXMAPLUMPNAME);
 	M_Memcpy(demobuf.p, mapmd5, 16); demobuf.p += 16;
 
 	WRITEUINT8(demobuf.p, demoflags);
@@ -2502,7 +2502,6 @@ UINT8 G_CmpDemoTime(char *oldname, char *newname)
 	UINT16 s ATTRUNUSED;
 	UINT8 aflags = 0;
 	boolean uselaps = false;
-	char discard[255];
 
 	// load the new file
 	FIL_DefaultExtension(newname, ".lmp");
@@ -2523,7 +2522,7 @@ UINT8 G_CmpDemoTime(char *oldname, char *newname)
 	p += 16; // demo checksum
 	I_Assert(!memcmp(p, "PLAY", 4));
 	p += 4; // PLAY
-	READSTRINGN(p, discard, sizeof(discard)); // gamemap
+	SKIPSTRING(p); // gamemap
 	p += 16; // map md5
 	flags = READUINT8(p); // demoflags
 	p++; // gametype
@@ -2581,7 +2580,7 @@ UINT8 G_CmpDemoTime(char *oldname, char *newname)
 		Z_Free(buffer);
 		return UINT8_MAX;
 	} p += 4; // "PLAY"
-	READSTRINGN(p, discard, sizeof(discard)); // gamemap
+	SKIPSTRING(p); // gamemap
 	p += 16; // mapmd5
 	flags = READUINT8(p);
 	p++; // gametype
@@ -3295,7 +3294,7 @@ void G_AddGhost(char *defdemoname)
 {
 	INT32 i;
 	lumpnum_t l;
-	char name[17],skin[17],color[MAXCOLORNAME+1],discard[255],*n,*pdemoname,md5[16];
+	char name[17],skin[17],color[MAXCOLORNAME+1],*n,*pdemoname,md5[16];
 	demoghost *gh;
 	UINT8 flags;
 	UINT8 *buffer,*p;
@@ -3384,7 +3383,7 @@ void G_AddGhost(char *defdemoname)
 	} p += 4; // "PLAY"
 
 
-	READSTRINGN(p, discard, sizeof(discard)); // gamemap
+	SKIPSTRING(p); // gamemap
 	p += 16; // mapmd5 (possibly check for consistency?)
 
 	flags = READUINT8(p);
@@ -3583,7 +3582,6 @@ void G_UpdateStaffGhostName(lumpnum_t l)
 	UINT8 *buffer,*p;
 	UINT16 ghostversion;
 	UINT8 flags;
-	char discard[255];
 
 	buffer = p = W_CacheLumpNum(l, PU_CACHE);
 
@@ -3617,7 +3615,7 @@ void G_UpdateStaffGhostName(lumpnum_t l)
 	}
 
 	p += 4; // "PLAY"
-	READSTRINGN(p, discard, sizeof(discard)); // gamemap
+	SKIPSTRING(p); // gamemap
 	p += 16; // mapmd5 (possibly check for consistency?)
 
 	flags = READUINT8(p);
diff --git a/src/g_game.c b/src/g_game.c
index c330b6ce3..26fbd54b1 100644
--- a/src/g_game.c
+++ b/src/g_game.c
@@ -4503,7 +4503,7 @@ void G_SaveGameData(void)
 	for (i = 0; i < nummapheaders; i++) // nummapheaders * (MAXMAPLUMPNAME+1+4+4)
 	{
 		// For figuring out which header to assing it to on load
-		WRITESTRING(save.p, mapheaderinfo[i]->lumpname);
+		WRITESTRINGN(save.p, mapheaderinfo[i]->lumpname, MAXMAPLUMPNAME);
 
 		WRITEUINT8(save.p, (mapheaderinfo[i]->mapvisited & MV_MAX));