From 7c4e1f1fcb55246aaf37d437df0bb3d8d28ebf4b Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Sat, 17 Mar 2012 16:16:12 +0100
Subject: [PATCH 01/11] .gitignore build artifacts

---
 .gitignore | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index e92ff2c3..c1704fc5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,7 @@
-
-# /
+/install/q3map2
+/install/radiant.bin
+/.sconsign.dblite
+/site.sconf
+/build
+*.pyc
+*.so

From 3311b00ae6f150aec8629b860f28c4bf92abef33 Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Sat, 17 Mar 2012 22:32:01 +0100
Subject: [PATCH 02/11] fix warning: format not a string literal and no format
 arguments

---
 contrib/bobtoolz/DBrush.cpp | 2 +-
 libs/synapse/synapse.cpp    | 2 +-
 radiant/main.cpp            | 4 ++--
 tools/quake3/common/inout.c | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/contrib/bobtoolz/DBrush.cpp b/contrib/bobtoolz/DBrush.cpp
index 34afabfe..3e54e797 100644
--- a/contrib/bobtoolz/DBrush.cpp
+++ b/contrib/bobtoolz/DBrush.cpp
@@ -694,7 +694,7 @@ void DBrush::SaveToFile( FILE *pFile ){
 				 ( *pp )->texInfo.m_fScale[0], ( *pp )->texInfo.m_fScale[0],
 				 ( *pp )->texInfo.m_fRotate );
 
-		fprintf( pFile, buffer );
+		fprintf( pFile, "%s", buffer );
 	}
 
 	fprintf( pFile, "}\n" );
diff --git a/libs/synapse/synapse.cpp b/libs/synapse/synapse.cpp
index 482204fd..c4dd78cc 100644
--- a/libs/synapse/synapse.cpp
+++ b/libs/synapse/synapse.cpp
@@ -65,7 +65,7 @@ void Syn_Printf( const char *text, ... ){
 		va_start( args, text );
 		vsnprintf( buf, BUFFER_SIZE, text, args );
 		buf[BUFFER_SIZE - 1] = 0;
-		printf( buf );
+		printf( "%s", buf );
 		va_end( args );
 	}
 }
diff --git a/radiant/main.cpp b/radiant/main.cpp
index 8e26926f..2fa52214 100644
--- a/radiant/main.cpp
+++ b/radiant/main.cpp
@@ -1145,7 +1145,7 @@ void RunBsp( char *command ){
 			Error( "Can't write to %s", batpath );
 		}
 		fprintf( hFile, "#!/bin/sh \n\n" );
-		fprintf( hFile, strSys.GetBuffer() );
+		fprintf( hFile, "%s", strSys.GetBuffer() );
 		fclose( hFile );
 		chmod( batpath, 0744 );
 #endif
@@ -1158,7 +1158,7 @@ void RunBsp( char *command ){
 		if ( !hFile ) {
 			Error( "Can't write to %s", batpath );
 		}
-		fprintf( hFile, strSys.GetBuffer() );
+		fprintf( hFile, "%s", strSys.GetBuffer() );
 		fclose( hFile );
 #endif
 
diff --git a/tools/quake3/common/inout.c b/tools/quake3/common/inout.c
index 74a111b8..acf492a2 100644
--- a/tools/quake3/common/inout.c
+++ b/tools/quake3/common/inout.c
@@ -264,7 +264,7 @@ void FPrintf( int flag, char *buf ){
 	static qboolean bGotXML = qfalse;
 	char level[2];
 
-	printf( buf );
+	printf( "%s", buf );
 
 	// the following part is XML stuff only.. but maybe we don't want that message to go down the XML pipe?
 	if ( flag == SYS_NOXML ) {

From cd725d680aae59c22191bfc3422da00c290e8716 Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Sat, 17 Mar 2012 22:58:48 +0100
Subject: [PATCH 03/11] fix warning: array subscript is above array bounds

Simplify and flatten the code while we're at it.
---
 radiant/brushscript.cpp | 44 ++++++++++++++---------------------------
 1 file changed, 15 insertions(+), 29 deletions(-)

diff --git a/radiant/brushscript.cpp b/radiant/brushscript.cpp
index 359fd299..d056b56b 100644
--- a/radiant/brushscript.cpp
+++ b/radiant/brushscript.cpp
@@ -426,42 +426,28 @@ void Input( char*& pBuffer ){
 	const char *fields[5] = { "", "", "", "", "" };
 	float values[5];
 
-	for ( int n = 0; n < g_nVariableCount; n++ )
+	for ( int n = 0; n < 5 && n < g_nVariableCount; n++ )
 	{
 		if ( g_Variables[n].m_strInput.GetLength() > 0 ) {
 			bGo = true;
-			if ( n < 5 ) {
-				switch ( n )
-				{
-				case 0: fields[1] = g_Variables[n].m_strInput.GetBuffer(); break;
-				case 1: fields[2] = g_Variables[n].m_strInput.GetBuffer(); break;
-				case 2: fields[3] = g_Variables[n].m_strInput.GetBuffer(); break;
-				case 3: fields[4] = g_Variables[n].m_strInput.GetBuffer(); break;
-				case 4: fields[5] = g_Variables[n].m_strInput.GetBuffer(); break;
-				}
-			}
+			fields[n] = g_Variables[n].m_strInput.GetBuffer();
 		}
 	}
 
-	if ( bGo ) {
-		if ( DoBSInputDlg( fields, values ) == IDOK ) {
-			for ( int n = 0; n < g_nVariableCount; n++ )
-			{
-				if ( g_Variables[n].m_strInput.GetLength() > 0 ) {
-					if ( n < 5 ) {
-						switch ( n )
-						{
-						case 0: g_Variables[n].m_fValue = values[1]; break;
-						case 1: g_Variables[n].m_fValue = values[2]; break;
-						case 2: g_Variables[n].m_fValue = values[3]; break;
-						case 3: g_Variables[n].m_fValue = values[4]; break;
-						case 4: g_Variables[n].m_fValue = values[5]; break;
-						}
-					}
-				}
-			}
+	if ( !bGo ) {
+		return;
+	}
+
+	if ( DoBSInputDlg( fields, values ) != IDOK ) {
+		g_bKeepGoing = false;
+		return;
+	}
+
+	for ( int n = 0; n < 5 && n < g_nVariableCount; n++ )
+	{
+		if ( g_Variables[n].m_strInput.GetLength() > 0 ) {
+			g_Variables[n].m_fValue = values[n];
 		}
-		else{ g_bKeepGoing = false; }
 	}
 }
 

From ca8d032cfb30858972aa9101b8820afd90cfbf82 Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Sat, 17 Mar 2012 23:09:08 +0100
Subject: [PATCH 04/11] fix warning: unused variable 'foo'

---
 libs/splines/splines.cpp                   | 7 ++-----
 libs/splines/util_str.cpp                  | 3 ---
 plugins/imagehl/lbmlib.cpp                 | 4 +---
 plugins/surface_heretic2/surfacedialog.cpp | 4 ----
 plugins/surface_ufoai/surfacedialog.cpp    | 4 ----
 tools/quake3/q3map2/light_ydnar.c          | 2 +-
 6 files changed, 4 insertions(+), 20 deletions(-)

diff --git a/libs/splines/splines.cpp b/libs/splines/splines.cpp
index c0d95c01..b9b7c0c9 100644
--- a/libs/splines/splines.cpp
+++ b/libs/splines/splines.cpp
@@ -393,7 +393,6 @@ void idSplineList::setSelectedPoint( idVec3 *p ) {
 
 const idVec3 *idSplineList::getPosition( long t ) {
 	static idVec3 interpolatedPos;
-	static long lastTime = -1;
 
 	int count = splineTime.Num();
 	if ( count == 0 ) {
@@ -644,7 +643,6 @@ bool idCameraDef::waitEvent( int index ) {
 
 void idCameraDef::buildCamera() {
 	int i;
-	int lastSwitch = 0;
 	idList<float> waits;
 	idList<int> targets;
 
@@ -653,7 +651,6 @@ void idCameraDef::buildCamera() {
 	// we have a base time layout for the path and the target path
 	// now we need to layer on any wait or speed changes
 	for ( i = 0; i < events.Num(); i++ ) {
-		idCameraEvent *ev = events[i];
 		events[i]->setTriggered( false );
 		switch ( events[i]->getType() ) {
 		case idCameraEvent::EVENT_TARGET: {
@@ -864,7 +861,8 @@ void idCameraDef::parse( const char *( *text )  ) {
 bool idCameraDef::load( const char *filename ) {
 	char *buf;
 	const char *buf_p;
-	int length = FS_ReadFile( filename, (void **)&buf );
+
+	FS_ReadFile( filename, (void **)&buf );
 	if ( !buf ) {
 		return false;
 	}
@@ -1363,7 +1361,6 @@ void idSplinePosition::write( fileHandle_t file, const char *p ) {
 }
 
 void idCameraDef::addTarget( const char *name, idCameraPosition::positionType type ) {
-	const char *text = ( name == NULL ) ? va( "target0%d", numTargets() + 1 ) : name;
 	idCameraPosition *pos = newFromType( type );
 	if ( pos ) {
 		pos->setName( name );
diff --git a/libs/splines/util_str.cpp b/libs/splines/util_str.cpp
index eb51533c..52a01a36 100644
--- a/libs/splines/util_str.cpp
+++ b/libs/splines/util_str.cpp
@@ -487,9 +487,6 @@ void TestStringClass
 	i = a.length();                 // i == 0
 	i = c.length();                 // i == 4
 
-	const char *s1 = a.c_str(); // s1 == "\0"
-	const char *s2 = c.c_str(); // s2 == "test\0"
-
 	t = new idStr();                        // t->len == 0, t->data == "\0"
 	delete t;                           // t == ?
 
diff --git a/plugins/imagehl/lbmlib.cpp b/plugins/imagehl/lbmlib.cpp
index 9262cda2..beb83b6d 100644
--- a/plugins/imagehl/lbmlib.cpp
+++ b/plugins/imagehl/lbmlib.cpp
@@ -133,8 +133,6 @@ static void LoadIDSP( const char *name, byte ** pic, int *width, int *height ){
 	dspriteframetype_t  *pframetype;
 	int version;
 	int numframes;
-	int size;
-	spriteframetype_t frametype;
 	dspriteframe_t *spriteframe;
 
 	*pic = NULL;
@@ -201,7 +199,7 @@ static void LoadIDSP( const char *name, byte ** pic, int *width, int *height ){
 	*pic = bmpRGBA;
 
 #ifdef DEBUG
-	frametype = spriteframetype_t( LittleLong( pframetype->type ) );
+	spriteframetype_t frametype = spriteframetype_t( LittleLong( pframetype->type ) );
 	if ( frametype == SPR_SINGLE ) {
 		Sys_Printf( "Single Frame\n" );
 	}
diff --git a/plugins/surface_heretic2/surfacedialog.cpp b/plugins/surface_heretic2/surfacedialog.cpp
index 829ad8d9..fd06da6d 100644
--- a/plugins/surface_heretic2/surfacedialog.cpp
+++ b/plugins/surface_heretic2/surfacedialog.cpp
@@ -219,7 +219,6 @@ static void on_cancel_button_clicked( GtkButton *button, gpointer user_data );
 void IsFaceConflicting(){
 	texdef_t* tmp_texdef;
 	texdef_to_face_t* temp_texdef_face_list;
-	char buf[12];
 	char texture_name[128];
 
 	if ( texdef_face_list_empty() ) {
@@ -328,7 +327,6 @@ static void PopulateTextureComboList(){
 	texdef_to_face_t* temp_texdef_face_list;
 	char blank[1];
 	GList *items = NULL;
-	GList *tmp_item;
 	int num_of_list_items = 0;
 
 	blank[0] = 0;
@@ -390,7 +388,6 @@ static void GetTexdefInfo_from_Radiant(){
 	g_texdef_face_vector.resize( count );
 
 	if ( !texdef_face_list_empty() ) {
-		texdef_to_face_t* p = get_texdef_face_list();
 		GetSelFacesTexdef( get_texdef_face_list() );
 	}
 
@@ -1861,7 +1858,6 @@ static void on_fit_button_clicked( GtkButton *button, gpointer user_data ){
 // Axial Button
 static void on_axial_button_clicked( GtkButton *button, gpointer user_data ){
 	texdef_t* tmp_texdef;
-	texdef_t* tmp_orig_texdef;
 	texdef_to_face_t* temp_texdef_face_list;
 
 	if ( !texdef_face_list_empty() && g_bListenChanged ) {
diff --git a/plugins/surface_ufoai/surfacedialog.cpp b/plugins/surface_ufoai/surfacedialog.cpp
index c6b9f0c8..5e0eebc2 100644
--- a/plugins/surface_ufoai/surfacedialog.cpp
+++ b/plugins/surface_ufoai/surfacedialog.cpp
@@ -220,7 +220,6 @@ static void on_cancel_button_clicked( GtkButton *button, gpointer user_data );
 void IsFaceConflicting(){
 	texdef_t* tmp_texdef;
 	texdef_to_face_t* temp_texdef_face_list;
-	char buf[12];
 	char texture_name[128];
 
 	if ( texdef_face_list_empty() ) {
@@ -329,7 +328,6 @@ static void PopulateTextureComboList(){
 	texdef_to_face_t* temp_texdef_face_list;
 	char blank[1];
 	GList *items = NULL;
-	GList *tmp_item;
 	int num_of_list_items = 0;
 
 	blank[0] = 0;
@@ -391,7 +389,6 @@ static void GetTexdefInfo_from_Radiant(){
 	g_texdef_face_vector.resize( count );
 
 	if ( !texdef_face_list_empty() ) {
-		texdef_to_face_t* p = get_texdef_face_list();
 		GetSelFacesTexdef( get_texdef_face_list() );
 	}
 
@@ -1861,7 +1858,6 @@ static void on_fit_button_clicked( GtkButton *button, gpointer user_data ){
 // Axial Button
 static void on_axial_button_clicked( GtkButton *button, gpointer user_data ){
 	texdef_t* tmp_texdef;
-	texdef_t* tmp_orig_texdef;
 	texdef_to_face_t* temp_texdef_face_list;
 
 	if ( !texdef_face_list_empty() && g_bListenChanged ) {
diff --git a/tools/quake3/q3map2/light_ydnar.c b/tools/quake3/q3map2/light_ydnar.c
index 794f2cb8..cb0430ea 100644
--- a/tools/quake3/q3map2/light_ydnar.c
+++ b/tools/quake3/q3map2/light_ydnar.c
@@ -3179,7 +3179,7 @@ void SetupEnvelopes( qboolean forGrid, qboolean fastFlag ){
 	int i, x, y, z, x1, y1, z1;
 	light_t     *light, *light2, **owner;
 	bspLeaf_t   *leaf;
-	vec3_t origin, dir, mins, maxs, nullVector = { 0, 0, 0 };
+	vec3_t origin, dir, mins, maxs;
 	float radius, intensity;
 	light_t     *buckets[ 256 ];
 

From 997811d430794eb9f3fedbb18838a1832a5efd0f Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Sat, 17 Mar 2012 23:53:12 +0100
Subject: [PATCH 05/11] q3map2: fix bogus empty string checks

qdir is an array, not a pointer, so `if (qdir)` is always true.
---
 tools/quake3/common/cmdlib.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/quake3/common/cmdlib.c b/tools/quake3/common/cmdlib.c
index 5f20773f..35f4d75b 100644
--- a/tools/quake3/common/cmdlib.c
+++ b/tools/quake3/common/cmdlib.c
@@ -244,7 +244,7 @@ char *ExpandArg( const char *path ){
 
 char *ExpandPath( const char *path ){
 	static char full[1024];
-	if ( !qdir ) {
+	if ( !qdir[0] ) {
 		Error( "ExpandPath called without qdir set" );
 	}
 	if ( path[0] == '/' || path[0] == '\\' || path[1] == ':' ) {
@@ -257,7 +257,7 @@ char *ExpandPath( const char *path ){
 
 char *ExpandGamePath( const char *path ){
 	static char full[1024];
-	if ( !qdir ) {
+	if ( !qdir[0] ) {
 		Error( "ExpandGamePath called without qdir set" );
 	}
 	if ( path[0] == '/' || path[0] == '\\' || path[1] == ':' ) {

From c2be26a9bdb2ec7ae7c817fd84885fa2a85521fb Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Sun, 18 Mar 2012 00:34:31 +0100
Subject: [PATCH 06/11] q3map2: add safe string copy functions

* Q_strncpyz()
* Q_strncat()
* Q_strcat()

Guard against buffer overruns, always zero terminate the result.
---
 tools/quake3/q3map2/main.c   | 32 ++++++++++++++++++++++++++++++++
 tools/quake3/q3map2/q3map2.h |  5 +++++
 2 files changed, 37 insertions(+)

diff --git a/tools/quake3/q3map2/main.c b/tools/quake3/q3map2/main.c
index 2ea7c923..e74a89cf 100644
--- a/tools/quake3/q3map2/main.c
+++ b/tools/quake3/q3map2/main.c
@@ -46,6 +46,38 @@ vec_t Random( void ){
 }
 
 
+char *Q_strncpyz( char *dst, const char *src, size_t len ) {
+	if ( len == 0 ) {
+		abort();
+	}
+
+	strncpy( dst, src, len );
+	dst[ len - 1 ] = '\0';
+	return dst;
+}
+
+
+char *Q_strcat( char *dst, size_t dlen, const char *src ) {
+	size_t n = strlen( dst  );
+
+	if ( n > dlen ) {
+		abort(); /* buffer overflow */
+	}
+
+	return Q_strncpyz( dst + n, src, dlen - n );
+}
+
+
+char *Q_strncat( char *dst, size_t dlen, const char *src, size_t slen ) {
+	size_t n = strlen( dst );
+
+	if ( n > dlen ) {
+		abort(); /* buffer overflow */
+	}
+
+	return Q_strncpyz( dst + n, src, MIN( slen, dlen - n ) );
+}
+
 
 /*
    ExitQ3Map()
diff --git a/tools/quake3/q3map2/q3map2.h b/tools/quake3/q3map2/q3map2.h
index bb756915..245e34c6 100644
--- a/tools/quake3/q3map2/q3map2.h
+++ b/tools/quake3/q3map2/q3map2.h
@@ -83,6 +83,8 @@
 
 #include <stdlib.h>
 
+#define MIN(a, b) ((a) < (b) ? (a) : (b))
+#define MAX(a, b) ((a) > (b) ? (a) : (b))
 
 
 /* -------------------------------------------------------------------------------
@@ -1446,6 +1448,9 @@ surfaceInfo_t;
 
 /* main.c */
 vec_t                       Random( void );
+char                        *Q_strncpyz( char *dst, const char *src, size_t len );
+char                        *Q_strcat( char *dst, size_t dlen, const char *src );
+char                        *Q_strncat( char *dst, size_t dlen, const char *src, size_t slen );
 int                         BSPInfo( int count, char **fileNames );
 int                         ScaleBSPMain( int argc, char **argv );
 int                         ConvertMain( int argc, char **argv );

From d7e9dab03d4791de2c2e31e401e51941fd68f294 Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Sun, 18 Mar 2012 00:26:28 +0100
Subject: [PATCH 07/11] q3map2: getpwent() result may not be persistent

Use getpwuid_r() instead and store the path in a static buffer.
---
 tools/quake3/q3map2/path_init.c | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/tools/quake3/q3map2/path_init.c b/tools/quake3/q3map2/path_init.c
index 6bd06135..ac8fa328 100644
--- a/tools/quake3/q3map2/path_init.c
+++ b/tools/quake3/q3map2/path_init.c
@@ -66,29 +66,23 @@ char *LokiGetHomeDir( void ){
 	#ifndef Q_UNIX
 	return NULL;
 	#else
+	static char	buf[ 4096 ];
+	struct passwd   pw, *pwp;
 	char            *home;
-	uid_t id;
-	struct passwd   *pwd;
 
 
 	/* get the home environment variable */
 	home = getenv( "HOME" );
-	if ( home == NULL ) {
-		/* do some more digging */
-		id = getuid();
-		setpwent();
-		while ( ( pwd = getpwent() ) != NULL )
-		{
-			if ( pwd->pw_uid == id ) {
-				home = pwd->pw_dir;
-				break;
-			}
-		}
-		endpwent();
+	if ( home ) {
+		return Q_strncpyz( buf, home, sizeof( buf ) );
 	}
 
-	/* return it */
-	return home;
+	/* look up home dir in password database */
+	if ( getpwuid_r( getuid(), &pw, buf, sizeof( buf ), &pwp ) == 0 ) {
+		return pw.pw_dir;
+	}
+
+	return NULL;
 	#endif
 }
 

From 808e1c9f6f81f93bc0331f3b8fda3b57778fb6bb Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Sun, 18 Mar 2012 01:53:03 +0100
Subject: [PATCH 08/11] q3map2: fix dangling pointer dereference

`last` was used but not initialized.

Also fixes a segmentation fault if PATH is not in the environment.
---
 tools/quake3/q3map2/path_init.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/tools/quake3/q3map2/path_init.c b/tools/quake3/q3map2/path_init.c
index ac8fa328..5a31644a 100644
--- a/tools/quake3/q3map2/path_init.c
+++ b/tools/quake3/q3map2/path_init.c
@@ -111,20 +111,16 @@ void LokiInitPaths( char *argv0 ){
 		home = ".";
 	}
 
+	path = getenv( "PATH" );
+
 	/* do some path divining */
 	strcpy( temp, argv0 );
 	if ( strrchr( temp, '/' ) ) {
 		argv0 = strrchr( argv0, '/' ) + 1;
 	}
-	else
-	{
-		/* get path environment variable */
-		path = getenv( "PATH" );
-
-		/* minor setup */
-		last[ 0 ] = path[ 0 ];
-		last[ 1 ] = '\0';
+	else if ( path ) {
 		found = qfalse;
+		last = path;
 
 		/* go through each : segment of path */
 		while ( last[ 0 ] != '\0' && found == qfalse )

From 3a959349aca0d064373da680d4c79b66e551e04a Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Sun, 18 Mar 2012 02:00:09 +0100
Subject: [PATCH 09/11] q3map2: harden UNIX path sniffer against buffer
 overflows

---
 tools/quake3/q3map2/path_init.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tools/quake3/q3map2/path_init.c b/tools/quake3/q3map2/path_init.c
index 5a31644a..901f07fc 100644
--- a/tools/quake3/q3map2/path_init.c
+++ b/tools/quake3/q3map2/path_init.c
@@ -114,7 +114,7 @@ void LokiInitPaths( char *argv0 ){
 	path = getenv( "PATH" );
 
 	/* do some path divining */
-	strcpy( temp, argv0 );
+	Q_strncpyz( temp, argv0, sizeof( temp ) );
 	if ( strrchr( temp, '/' ) ) {
 		argv0 = strrchr( argv0, '/' ) + 1;
 	}
@@ -136,17 +136,17 @@ void LokiInitPaths( char *argv0 ){
 
 			/* found home dir candidate */
 			if ( *path == '~' ) {
-				strcpy( temp, home );
+				Q_strncpyz( temp, home, sizeof( temp ) );
 				path++;
 			}
 
 			/* concatenate */
 			if ( last > ( path + 1 ) ) {
-				strncat( temp, path, ( last - path ) );
-				strcat( temp, "/" );
+				Q_strncat( temp, sizeof( temp ), path, ( last - path ) );
+				Q_strcat( temp, sizeof( temp ), "/" );
 			}
-			strcat( temp, "./" );
-			strcat( temp, argv0 );
+			Q_strcat( temp, sizeof( temp ), "./" );
+			Q_strcat( temp, sizeof( temp ), argv0 );
 
 			/* verify the path */
 			if ( access( temp, X_OK ) == 0 ) {

From f961a547ff4230225315d027c5ce4845d5ba420d Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Sun, 18 Mar 2012 02:02:48 +0100
Subject: [PATCH 10/11] q3map2: bump MAX_OS_PATH to 4096

Fixes a "buffer overflow detected" abort when compiled with _FORTIFY_SOURCE=1.

The realpath(3) function in glibc checks if the destination buffer is large
enough to hold up to PATH_MAX characters and aborts if that is not the case.
PATH_MAX doesn't have to be defined so assume that it's equal to 4096.

We should really be using pathconf(_PC_PATH_MAX) instead of a hard-coded value
but that means we can no longer use static buffers to hold paths.
---
 tools/quake3/common/cmdlib.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/quake3/common/cmdlib.h b/tools/quake3/common/cmdlib.h
index e7b555b4..3fb98feb 100644
--- a/tools/quake3/common/cmdlib.h
+++ b/tools/quake3/common/cmdlib.h
@@ -53,7 +53,7 @@
 #endif
 
 
-#define MAX_OS_PATH     1024
+#define MAX_OS_PATH     4096
 #define MEM_BLOCKSIZE 4096
 
 // the dec offsetof macro doesnt work very well...

From d3e3a8e063ad587ab92af39b9b93244b249df450 Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Sat, 17 Mar 2012 16:13:32 +0100
Subject: [PATCH 11/11] build: re-enable optimizations in release builds

Commit f961a54 fixes the q3map2 crash at startup so it's safe to enable
optimizations again.
---
 config.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/config.py b/config.py
index f55b7bfa..4c441393 100644
--- a/config.py
+++ b/config.py
@@ -247,9 +247,8 @@ class Config:
 			env.Append( CXXFLAGS = [ '-g' ] )
 			env.Append( CPPDEFINES = [ '_DEBUG' ] )
 		else:
-                        # '-O' causes q3map2 errors on Ubuntu 10.10 32 bit.
-			env.Append( CFLAGS = [ ] )
-			env.Append( CXXFLAGS = [ ] )
+			env.Append( CFLAGS = [ '-O2', '-fno-strict-aliasing' ] )
+			env.Append( CXXFLAGS = [ '-O2', '-fno-strict-aliasing' ] )
 
 	def CheckoutOrUpdate( self, svnurl, path ):
 		if ( os.path.exists( path ) ):