okseby/Quake-III-Arena
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add string length checking to function COM_StripExtension. This fixes the R_RemapShader buffer overflow exploit that can be found here:

Browse source 
http://milw0rm.com/exploits/1750
This commit is contained in:
Thilo Schulz 2006-05-06 01:56:24 +00:00
parent 2e368c02a6
commit d21411452e
13 changed files with 22 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

2
code/qcommon/files.c
View file

@ -3451,7 +3451,7 @@ void FS_FilenameCompletion( const char *dir, const char *ext,
Q_strncpyz( filename, filenames[ i ], MAX_STRING_CHARS );
if( stripExt ) {
COM_StripExtension( filename, filename );
COM_StripExtension(filename, filename, sizeof(filename));
}
callback( filename );

4
code/qcommon/q_shared.c
View file

@ -58,10 +58,10 @@ char *COM_SkipPath (char *pathname)
COM_StripExtension
============
*/
void COM_StripExtension( const char *in, char *out ) {
void COM_StripExtension( const char *in, char *out, int destsize ) {
int length;
strcpy( out, in );
Q_strncpyz(out, in, destsize);
length = strlen(out)-1;
while (length > 0 && out[length] != '.')

2
code/qcommon/q_shared.h
View file

@ -588,7 +588,7 @@ int Q_isnan( float x );
float Com_Clamp( float min, float max, float value );
char *COM_SkipPath( char *pathname );
void COM_StripExtension( const char *in, char *out );
void COM_StripExtension(const char *in, char *out, int destsize);
void COM_DefaultExtension( char *path, int maxSize, const char *extension );
void COM_BeginParseSession( const char *name );

2
code/qcommon/vm.c
View file

@ -230,7 +230,7 @@ void VM_LoadSymbols( vm_t *vm ) {
return;
}
COM_StripExtension( vm->name, name );
COM_StripExtension(vm->name, name, sizeof(name));
Com_sprintf( symbols, sizeof( symbols ), "vm/%s.map", name );
len = FS_ReadFile( symbols, (void **)&mapfile );
if ( !mapfile ) {