incidentalstoat/blankart
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

G_SaveDemo: fix oob reads/writes for replay names

Browse source 
66f67c91e8
This commit is contained in:
NepDisk 2025-10-16 14:07:44 -04:00
parent 9081c4d177
commit bb0f368080
1 changed files with 15 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
src/g_demo.c
View file

@ -4397,7 +4397,8 @@ void G_SaveDemo(void)
size_t i, strindex = 0;
boolean dash = true;
for (i = 0; demo.titlename[i] && i < 127; i++)
//for (i = 0; demo.titlename[i] && i < 127; i++) ?????
for (i = 0; i < 64 && demo.titlename[i]; i++)
{
if ((demo.titlename[i] >= 'a' && demo.titlename[i] <= 'z') ||
(demo.titlename[i] >= '0' && demo.titlename[i] <= '9'))
@ -4429,9 +4430,19 @@ void G_SaveDemo(void)
if (demo_slug[0] != '\0')
{
// Slug is valid, write the chosen filename.
writepoint = strstr(strrchr(demoname, *PATHSEP), "-") + 1;
demo_slug[128 - (writepoint - demoname) - 4] = 0;
sprintf(writepoint, "%s.lmp", demo_slug);
writepoint = strstr(strrchr(demoname, *PATHSEP), "-");
if (!writepoint)
return;
writepoint++;
size_t flen = 128 - (writepoint - demoname) - 4;
if (flen > 0 && flen < 128)
{
demo_slug[flen] = '\0';
sprintf(writepoint, "%s.lmp", demo_slug);
}
}
}