okseby/Quake-III-Arena
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #118 from jkent/master

Browse source 
fix buffer overflow in CL_CheckForResend
This commit is contained in:
Zack Middleton 2015-06-18 13:09:58 -05:00
commit e857ed7273
1 changed files with 4 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

19
code/client/cl_main.c
View file

@ -2301,9 +2301,9 @@ Resend a connect message if the last one has timed out
================= =================
*/ */
void CL_CheckForResend( void ) { void CL_CheckForResend( void ) {
int port, i; int port;
char info[MAX_INFO_STRING]; char info[MAX_INFO_STRING];
char data[MAX_INFO_STRING]; char data[MAX_INFO_STRING + 10];
// don't send anything if playing back a demo // don't send anything if playing back a demo
if ( clc.demoplaying ) { if ( clc.demoplaying ) {
@ -2357,19 +2357,8 @@ void CL_CheckForResend( void ) {
Info_SetValueForKey( info, "qport", va("%i", port ) ); Info_SetValueForKey( info, "qport", va("%i", port ) );
Info_SetValueForKey( info, "challenge", va("%i", clc.challenge ) ); Info_SetValueForKey( info, "challenge", va("%i", clc.challenge ) );
strcpy(data, "connect "); Com_sprintf( data, sizeof(data), "connect \"%s\"", info );
// TTimo adding " " around the userinfo string to avoid truncated userinfo on the server NET_OutOfBandData( NS_CLIENT, clc.serverAddress, (byte *) data, strlen ( data ) );
// (Com_TokenizeString tokenizes around spaces)
data[8] = '"';
for(i=0;i<strlen(info);i++) {
data[9+i] = info[i]; // + (clc.challenge)&0x3;
}
data[9+i] = '"';
data[10+i] = 0;
// NOTE TTimo don't forget to set the right data length!
NET_OutOfBandData( NS_CLIENT, clc.serverAddress, (byte *) &data[0], i+10 );
// the most current userinfo has been sent, so watch for any // the most current userinfo has been sent, so watch for any
// newer changes to userinfo variables // newer changes to userinfo variables
cvar_modifiedFlags &= ~CVAR_USERINFO; cvar_modifiedFlags &= ~CVAR_USERINFO;