cleanup: strcpy to strncpy, strcat to strncat...

contrib/bkgrnd2d/dialog.cpp

@@ -36,8 +36,7 @@
 // spaces to make label nice and big
 #define NO_FILE_MSG "        (no file loaded)        "
 
-#ifdef _WIN32
+#if defined(_MSC_VER) && _MSC_VER<1900 && !(defined snprintf)
-// TTimo: THIS IS UGLY
 #define snprintf _snprintf
 #endif
 
@@ -124,17 +123,17 @@ void CBackgroundDialogPage::Browse(){
 		return;
 	}
 
-	strcpy( browsedir,ct );
+	Q_strncpyz( browsedir, ct, sizeof( browsedir ) );
 	// make sure we have a trailing /
 	if ( browsedir[strlen( browsedir ) - 1] != '/' ) {
-		strcat( browsedir,"/" );
+		strncat( browsedir, "/", sizeof( browsedir ) );
 	}
 
 	//if we dont have a file yet, don't try to use it for default dir
 	if ( m_bValidFile ) {
 		// filename should always be a nice clean unix style relative path
 		ct = gtk_label_get_text( GTK_LABEL( m_pFileLabel ) );
-		strcat( browsedir,ct );
+		strncat( browsedir, ct, sizeof( browsedir ) );
 		Syn_Printf( MSG_PREFIX "full path: %s\n",browsedir );
 
 		// lop off the file part
@@ -171,7 +170,7 @@ void CBackgroundDialogPage::Browse(){
 
 void CBackgroundDialogPage::SetPosLabel(){
 	char s[64];
-	snprintf( s, sizeof( s ) - 1, _( "Size/Position (%d,%d) (%d,%d)" ),(int)( m_pImage->m_xmin ),
+	snprintf( s, sizeof( s ), _( "Size/Position (%d,%d) (%d,%d)" ),(int)( m_pImage->m_xmin ),
 			  (int)( m_pImage->m_ymin ),(int)( m_pImage->m_xmax ),(int)( m_pImage->m_ymax ) );
 	gtk_label_set_text( GTK_LABEL( m_pPosLabel ),s );
 }

contrib/bobtoolz/DBobView.cpp

@@ -313,8 +313,8 @@ bool DBobView::CalculateTrajectory( vec3_t start, vec3_t apex, float multiplier,
 }
 
 void DBobView::Begin( const char* trigger, const char *target, float multiplier, int points, float varGravity, bool bNoUpdate, bool bShowExtra ){
-	strcpy( entTrigger, trigger );
+	Q_strncpyz( entTrigger, trigger, sizeof( entTrigger ) );
-	strcpy( entTarget, target );
+	Q_strncpyz( entTarget, target, sizeof( entTarget ) );
 
 	fMultiplier = multiplier;
 	fVarGravity = varGravity;

contrib/bobtoolz/DBrush.cpp

@@ -683,9 +683,9 @@ void DBrush::SaveToFile( FILE *pFile ){
 
 	for ( list<DPlane *>::const_iterator pp = faceList.begin(); pp != faceList.end(); pp++ )
 	{
-		char buffer[512];
+		char buffer[720 + PATH_MAX];
 
-		sprintf( buffer, "( %.0f %.0f %.0f ) ( %.0f %.0f %.0f ) ( %.0f %.0f %.0f ) %s %.0f %.0f %f %f %.0f 0 0 0\n",
+		snprintf( buffer, sizeof( buffer ), "( %.0f %.0f %.0f ) ( %.0f %.0f %.0f ) ( %.0f %.0f %.0f ) %s %.0f %.0f %f %f %.0f 0 0 0\n",
 				 ( *pp )->points[0][0], ( *pp )->points[0][1], ( *pp )->points[0][2],
 				 ( *pp )->points[1][0], ( *pp )->points[1][1], ( *pp )->points[1][2],
 				 ( *pp )->points[2][0], ( *pp )->points[2][1], ( *pp )->points[2][2],
@@ -727,7 +727,7 @@ bool DBrush::ResetTextures( const char* textureName, float fScale[2],    float f
 		{
 			if ( !strcmp( ( *resetPlane )->texInfo.m_TextureName, textureName ) ) {
 				if ( bResetTextureName ) {
-					strcpy( ( *resetPlane )->texInfo.m_TextureName, newTextureName );
+					Q_strncpyz( ( *resetPlane )->texInfo.m_TextureName, newTextureName, sizeof( ( *resetPlane )->texInfo.m_TextureName ) );
 				}
 
 				if ( bResetScale[0] ) {
@@ -758,7 +758,7 @@ bool DBrush::ResetTextures( const char* textureName, float fScale[2],    float f
 		for ( list<DPlane *>::const_iterator resetPlane = faceList.begin(); resetPlane != faceList.end(); resetPlane++ )
 		{
 			if ( bResetTextureName ) {
-				strcpy( ( *resetPlane )->texInfo.m_TextureName, newTextureName );
+				Q_strncpyz( ( *resetPlane )->texInfo.m_TextureName, newTextureName, sizeof( ( *resetPlane )->texInfo.m_TextureName ) );
 			}
 
 			if ( bResetScale[0] ) {

contrib/bobtoolz/DEntity.cpp

@@ -120,7 +120,7 @@ char* getNextBracket( char* s ){
 
 bool DEntity::LoadFromPrt( char *filename ){
 	CPortals portals;
-	strcpy( portals.fn, filename );
+	Q_strncpyz( portals.fn, filename, sizeof( portals.fn ) );
 	portals.Load();
 
 	if ( portals.node_count == 0 ) {

contrib/bobtoolz/DPatch.cpp

@@ -48,7 +48,7 @@ DPatch::~DPatch(){
 }
 
 void DPatch::SetTexture( const char *textureName ){
-	strcpy( texture, textureName );
+	Q_strncpyz( texture, textureName, sizeof( texture ) );
 }
 
 void CopyDrawVert( const drawVert_t* in, drawVert_t* out ){
@@ -124,7 +124,7 @@ void DPatch::RemoveFromRadiant(){
 
 bool DPatch::ResetTextures( const char *oldTextureName, const char *newTextureName ){
 	if ( !oldTextureName || !strcmp( texture, oldTextureName ) ) {
-		strcpy( texture, newTextureName );
+		Q_strncpyz( texture, newTextureName, sizeof( texture ) );
 		return TRUE;
 	}
 

contrib/bobtoolz/DShape.cpp

@@ -367,7 +367,7 @@ bool DShape::BuildPit( vec3_t min, vec3_t max ){
 	int team = ( rand() % 10000 ) + 5000;
 
 // ************* SPEAKER ***************
-	sprintf( buffer, "t%i_1", team );
+	snprintf( buffer, sizeof( buffer ), "t%i_1", team );
 
 // trigger for speaker
 	vec3_t triggerVoiceBtm;
@@ -388,7 +388,7 @@ bool DShape::BuildPit( vec3_t min, vec3_t max ){
 	DEntity* targetVoice = m_Container.AddEntity( "target_speaker" );
 	targetVoice->AddEPair( "targetname", buffer );
 
-	sprintf( buffer, "%f %f %f", voiceOrigin[0], voiceOrigin[1], voiceOrigin[2] );
+	snprintf( buffer, sizeof( buffer ), "%f %f %f", voiceOrigin[0], voiceOrigin[1], voiceOrigin[2] );
 	targetVoice->AddEPair( "origin", buffer );
 	targetVoice->AddEPair( "spawnflags", "8" );
 	targetVoice->AddEPair( "noise", "*falling1.wav" );
@@ -397,7 +397,7 @@ bool DShape::BuildPit( vec3_t min, vec3_t max ){
 // *********** END SPEAKER *************
 
 // ********* POWERUP REMOVAL ***********
-	sprintf( buffer, "t%i_2", team );
+	snprintf( buffer, sizeof( buffer ), "t%i_2", team );
 
 // trigger for powerup removal
 	vec3_t triggerPwrRmvTop, triggerPwrRmvBtm;
@@ -420,7 +420,7 @@ bool DShape::BuildPit( vec3_t min, vec3_t max ){
 	DEntity* targetPwrRmv = m_Container.AddEntity( "target_remove_powerups" );
 	targetPwrRmv->AddEPair( "targetname", buffer );
 
-	sprintf( buffer, "%f %f %f", pwrRmvOrigin[0], pwrRmvOrigin[1], pwrRmvOrigin[2] );
+	snprintf( buffer, sizeof( buffer ), "%f %f %f", pwrRmvOrigin[0], pwrRmvOrigin[1], pwrRmvOrigin[2] );
 	targetPwrRmv->AddEPair( "origin", buffer );
 //--------------------
 

contrib/bobtoolz/DTrainDrawer.cpp

@@ -191,7 +191,7 @@ void DTrainDrawer::Draw2D( VIEWTYPE vt ) {
 
 void AddSplineControl( const char* control, splinePoint_t* pSP ) {
 	controlPoint_t cp;
-	strncpy( cp.strName, control, 64 );
+	Q_strncpyz( cp.strName, control, sizeof( cp.strName ) );
 
 	pSP->m_pointList.push_front( cp );
 }
@@ -235,8 +235,8 @@ void DTrainDrawer::BuildPaths() {
 					AddSplineControl( control, pSP );
 
 					for ( int j = 2;; j++ ) {
-						char buffer[16];
+						char buffer[32];
-						sprintf( buffer, "control%i", j );
+						snprintf( buffer, sizeof( buffer ), "control%i", j );
 
 						e.SpawnString( buffer, NULL, &control );
 						if ( !control ) {
@@ -324,7 +324,7 @@ void DTrainDrawer::BuildPaths() {
 void DTrainDrawer::AddControlPoint( const char* name, vec_t* origin ){
 	controlPoint_t* pCP = new controlPoint_t;
 
-	strncpy( pCP->strName, name, 64 );
+	Q_strncpyz( pCP->strName, name, sizeof( pCP->strName ) );
 	VectorCopy( origin, pCP->vOrigin );
 
 	m_pointList.push_back( pCP );
@@ -333,8 +333,8 @@ void DTrainDrawer::AddControlPoint( const char* name, vec_t* origin ){
 splinePoint_t* DTrainDrawer::AddSplinePoint( const char* name, const char* target, vec_t* origin ){
 	splinePoint_t* pSP = new splinePoint_t;
 
-	strncpy( pSP->point.strName, name,       64 );
+	Q_strncpyz( pSP->point.strName, name, sizeof( pSP->point.strName ) );
-	strncpy( pSP->strTarget,     target,     64 );
+	Q_strncpyz( pSP->strTarget, target, sizeof( pSP->strTarget ) );
 	VectorCopy( origin, pSP->point.vOrigin );
 	m_splineList.push_back( pSP );
 

contrib/bobtoolz/DTreePlanter.cpp

@@ -47,7 +47,7 @@ bool DTreePlanter::OnLButtonDown( guint32 nFlags, gdouble x, gdouble y ) {
 		char buffer[128];
 		DEntity e( m_entType );
 
-		sprintf( buffer, "%i %i %i", (int)vhit[0], (int)vhit[1], (int)vhit[2] );
+		snprintf( buffer, sizeof( buffer ), "%i %i %i", (int)vhit[0], (int)vhit[1], (int)vhit[2] );
 		e.AddEPair( "origin", buffer );
 
 		if ( m_autoLink ) {
@@ -56,7 +56,7 @@ bool DTreePlanter::OnLButtonDown( guint32 nFlags, gdouble x, gdouble y ) {
 
 			int entNum = -1, lastEntNum = -1, entpos;
 			for ( int i = 0; i < 256; i++ ) {
-				sprintf( buffer, m_linkName, i );
+				snprintf( buffer, sizeof( buffer ), m_linkName, i );
 				pThisEntity = FindEntityFromTargetname( buffer, &entNum );
 
 				if ( pThisEntity ) {
@@ -67,10 +67,10 @@ bool DTreePlanter::OnLButtonDown( guint32 nFlags, gdouble x, gdouble y ) {
 			}
 
 			if ( !pLastEntity ) {
-				sprintf( buffer, m_linkName, 0 );
+				snprintf( buffer, sizeof( buffer ), m_linkName, 0 );
 			}
 			else {
-				sprintf( buffer, m_linkName, entpos + 1 );
+				snprintf( buffer, sizeof( buffer ), m_linkName, entpos + 1 );
 			}
 
 			e.AddEPair( "targetname", buffer );
@@ -88,7 +88,7 @@ bool DTreePlanter::OnLButtonDown( guint32 nFlags, gdouble x, gdouble y ) {
 			int angleYaw = ( rand() % ( m_maxYaw - m_minYaw + 1 ) ) + m_minYaw;
 			int anglePitch = ( rand() % ( m_maxPitch - m_minPitch + 1 ) ) + m_minPitch;
 
-			sprintf( buffer, "%i %i 0", anglePitch, angleYaw );
+			snprintf( buffer, sizeof( buffer ), "%i %i 0", anglePitch, angleYaw );
 			e.AddEPair( "angles", buffer );
 		}
 
@@ -100,7 +100,7 @@ bool DTreePlanter::OnLButtonDown( guint32 nFlags, gdouble x, gdouble y ) {
 		if ( m_useScale ) {
 			float scale = ( ( ( rand() % 1000 ) * 0.001f ) * ( m_maxScale - m_minScale ) ) + m_minScale;
 
-			sprintf( buffer, "%f", scale );
+			snprintf( buffer, sizeof( buffer ), "%f", scale );
 			e.AddEPair( "modelscale", buffer );
 		}
 
@@ -205,7 +205,7 @@ void DTreePlanter::DropEntsToGround( void ) {
 		FindDropPoint( vec, out );
 
 		char buffer[256];
-		sprintf( buffer, "%f %f %f", out[0], out[1], out[2] );
+		snprintf( buffer, sizeof( buffer ), "%f %f %f", out[0], out[1], out[2] );
 		ent.AddEPair( "origin", buffer );
 		ent.RemoveFromRadiant();
 		ent.BuildInRadiant( FALSE );
@@ -221,17 +221,17 @@ void DTreePlanter::MakeChain( void ) {
 	for ( i = 0; i < m_linkNum; i++ ) {
 		DEntity e( "info_train_spline_main" );
 
-		sprintf( buffer, "%s_pt%i", m_linkName, i );
+		snprintf( buffer, sizeof( buffer ), "%s_pt%i", m_linkName, i );
 		e.AddEPair( "targetname", buffer );
 
-		sprintf( buffer, "0 %i 0", i * 64 );
+		snprintf( buffer, sizeof( buffer ), "0 %i 0", i * 64 );
 		e.AddEPair( "origin", buffer );
 
 		if ( i != m_linkNum - 1 ) {
-			sprintf( buffer, "%s_pt%i", m_linkName, i + 1 );
+			snprintf( buffer, sizeof( buffer ), "%s_pt%i", m_linkName, i + 1 );
 			e.AddEPair( "target", buffer );
 
-			sprintf( buffer, "%s_ctl%i", m_linkName, i );
+			snprintf( buffer, sizeof( buffer ), "%s_ctl%i", m_linkName, i );
 			e.AddEPair( "control", buffer );
 		}
 
@@ -241,10 +241,10 @@ void DTreePlanter::MakeChain( void ) {
 	for ( i = 0; i < m_linkNum - 1; i++ ) {
 		DEntity e( "info_train_spline_control" );
 
-		sprintf( buffer, "%s_ctl%i", m_linkName, i );
+		snprintf( buffer, sizeof( buffer ), "%s_ctl%i", m_linkName, i );
 		e.AddEPair( "targetname", buffer );
 
-		sprintf( buffer, "0 %i 0", ( i * 64 ) + 32 );
+		snprintf( buffer, sizeof( buffer ), "0 %i 0", ( i * 64 ) + 32 );
 		e.AddEPair( "origin", buffer );
 
 		e.BuildInRadiant( FALSE );

contrib/bobtoolz/DTreePlanter.h

@@ -66,7 +66,7 @@ DTreePlanter() {
 	m_world.LoadSelectedBrushes();
 
 	char buffer[256];
-	GetFilename( buffer, "bt/tp_ent.txt" );
+	GetFilename( buffer, "bt/tp_ent.txt", sizeof( buffer ) );
 
 	FILE* file = fopen( buffer, "rb" );
 	if ( file ) {

contrib/bobtoolz/bobToolz-GTK.cpp

@@ -287,11 +287,11 @@ const char* CSynapseClientBobtoolz::GetInfo(){
 	return "bobToolz module built " __DATE__ " " RADIANT_VERSION;
 }
 
-char* GetFilename( char* buffer, const char* filename ) {
+char* GetFilename( char* buffer, const char* filename, size_t length ) {
-	strcpy( buffer, g_pSynapseServer->GetModuleFilename( &g_SynapseClient ) );
+	Q_strncpyz( buffer, g_pSynapseServer->GetModuleFilename( &g_SynapseClient ), length );
 	StripFilename( buffer );
-	strcat( buffer, "/" );
+	strncat( buffer, "/", length );
-	strcat( buffer, filename );
+	strncat( buffer, filename, length );
 	buffer = UnixToDosPath( buffer );
 	return buffer;
 }

contrib/bobtoolz/dialogs/dialogs-gtk.cpp

@@ -130,7 +130,7 @@ bool ValidateTextFloat( const char* pData, const char* error_title, float* value
 
 bool ValidateTextFloatRange( const char* pData, float min, float max, const char* error_title, float* value ){
 	char error_buffer[256];
-	sprintf( error_buffer, "Please Enter A Floating Point Number Between %.3f and %.3f", min, max );
+	snprintf( error_buffer, sizeof( error_buffer ), "Please Enter A Floating Point Number Between %.3f and %.3f", min, max );
 
 	if ( pData ) {
 		float testNum = (float)atof( pData );
@@ -152,7 +152,7 @@ bool ValidateTextFloatRange( const char* pData, float min, float max, const char
 
 bool ValidateTextIntRange( const char* pData, int min, int max, const char* error_title, int* value ){
 	char error_buffer[256];
-	sprintf( error_buffer, "Please Enter An Integer Between %i and %i", min, max );
+	snprintf( error_buffer, sizeof( error_buffer ), "Please Enter An Integer Between %i and %i", min, max );
 
 	if ( pData ) {
 		int testNum = atoi( pData );
@@ -793,8 +793,8 @@ int DoBuildStairsBox( BuildStairsRS* rs ){
 		if ( ret == IDOK ) {
 			rs->bUseDetail = gtk_toggle_button_get_active( (GtkToggleButton*)checkUseDetail ) ? true : false;
 
-			strcpy( rs->riserTexture, gtk_entry_get_text( (GtkEntry*)textRiserTex ) );
+			Q_strncpyz( rs->riserTexture, gtk_entry_get_text( (GtkEntry*)textRiserTex ), sizeof( rs->riserTexture ) );
-			strcpy( rs->mainTexture, gtk_entry_get_text( (GtkEntry*)textMainTex ) );
+			Q_strncpyz( rs->mainTexture, gtk_entry_get_text( (GtkEntry*)textMainTex ), sizeof( rs->mainTexture ) );
 
 			if ( gtk_toggle_button_get_active( (GtkToggleButton*)radioNorth ) ) {
 				rs->direction = MOVE_NORTH;
@@ -864,8 +864,8 @@ int DoDoorsBox( DoorRS* rs ){
 	char buffer[256];
 	GList       *listMainTextures = NULL;
 	GList       *listTrimTextures = NULL;
-	LoadGList( GetFilename( buffer, "plugins/bt/door-tex.txt" ), &listMainTextures );
+	LoadGList( GetFilename( buffer, "plugins/bt/door-tex.txt", sizeof( buffer ) ), &listMainTextures );
-	LoadGList( GetFilename( buffer, "plugins/bt/door-tex-trim.txt" ), &listTrimTextures );
+	LoadGList( GetFilename( buffer, "plugins/bt/door-tex-trim.txt", sizeof( buffer ) ), &listTrimTextures );
 
 	vbox = gtk_vbox_new( FALSE, 10 );
 	gtk_container_add( GTK_CONTAINER( window ), vbox );
@@ -1031,8 +1031,8 @@ int DoDoorsBox( DoorRS* rs ){
 	while ( loop )
 		gtk_main_iteration();
 
-	strcpy( rs->mainTexture, gtk_entry_get_text( GTK_ENTRY( textFrontBackTex ) ) );
+	Q_strncpyz( rs->mainTexture, gtk_entry_get_text( GTK_ENTRY( textFrontBackTex ) ), sizeof( rs->mainTexture ) );
-	strcpy( rs->trimTexture, gtk_entry_get_text( GTK_ENTRY( textTrimTex ) ) );
+	Q_strncpyz( rs->trimTexture, gtk_entry_get_text( GTK_ENTRY( textTrimTex ) ), sizeof( rs->trimTexture ) );
 
 	rs->bScaleMainH = gtk_toggle_button_get_active( GTK_TOGGLE_BUTTON( checkScaleMainH ) ) ? true : false;
 	rs->bScaleMainV = gtk_toggle_button_get_active( GTK_TOGGLE_BUTTON( checkScaleMainV ) ) ? true : false;
@@ -1614,8 +1614,8 @@ int DoResetTextureBox( ResetTextureRS* rs ){
 
 			rs->bResetTextureName =  gtk_toggle_button_get_active( GTK_TOGGLE_BUTTON( dlgTexReset.cbTexChange ) );
 			if ( rs->bResetTextureName ) {
-				strcpy( rs->textureName,     gtk_entry_get_text( GTK_ENTRY( dlgTexReset.editTexOld ) ) );
+				Q_strncpyz( rs->textureName,     gtk_entry_get_text( GTK_ENTRY( dlgTexReset.editTexOld ) ), sizeof( rs->textureName ) );
-				strcpy( rs->newTextureName,  gtk_entry_get_text( GTK_ENTRY( dlgTexReset.editTexNew ) ) );
+				Q_strncpyz( rs->newTextureName,  gtk_entry_get_text( GTK_ENTRY( dlgTexReset.editTexNew ) ), sizeof( rs->newTextureName ) );
 			}
 		}
 	}

contrib/bobtoolz/funchandlers-GTK.cpp

@@ -55,13 +55,13 @@ DTreePlanter*   g_TreePlanter =     NULL;
 //========================//
 
 void LoadLists(){
-	char buffer[256];
+	char buffer[PATH_MAX];
 
 	if ( !el1Loaded ) {
-		el1Loaded = LoadExclusionList( GetFilename( buffer, "bt/bt-el1.txt" ), &exclusionList );
+		el1Loaded = LoadExclusionList( GetFilename( buffer, "bt/bt-el1.txt", sizeof( buffer ) ), &exclusionList );
 	}
 	if ( !el2Loaded ) {
-		el2Loaded = LoadExclusionList( GetFilename( buffer, "bt/bt-el2.txt" ), &exclusionList_Face );
+		el2Loaded = LoadExclusionList( GetFilename( buffer, "bt/bt-el2.txt", sizeof( buffer ) ), &exclusionList_Face );
 	}
 }
 
@@ -186,7 +186,7 @@ void DoResetTextures(){
 	else
 	{
 		texName = GetCurrentTexture();
-		strcpy( rs.textureName, GetCurrentTexture() );
+		Q_strncpyz( rs.textureName, GetCurrentTexture(), sizeof( rs.textureName ) );
 	}
 
 	int ret;
@@ -216,7 +216,7 @@ void DoResetTextures(){
 void DoBuildStairs( vec3_t vMin, vec3_t vMax ){
 	BuildStairsRS rs;
 
-	strcpy( rs.mainTexture, GetCurrentTexture() );
+	Q_strncpyz( rs.mainTexture, GetCurrentTexture(), sizeof( rs.mainTexture ) );
 
 	// ensure we have something selected
 	if ( g_FuncTable.m_pfnSelectedBrushCount() != 1 ) {
@@ -319,7 +319,7 @@ void DoBuildDoors( vec3_t vMin, vec3_t vMax ){
 	// cant release until we delete the brush, if we do...
 
 	DoorRS rs;
-	strcpy( rs.mainTexture, GetCurrentTexture() );
+	Q_strncpyz( rs.mainTexture, GetCurrentTexture(), sizeof( rs.mainTexture ) );
 
 	if ( DoDoorsBox( &rs ) == IDOK ) {
 		g_FuncTable.m_pfnDeleteBrushHandle( brush );
@@ -554,7 +554,7 @@ void DoVisAnalyse(){
 		return;
 	}
 
-	strcpy( filename, rad_filename );
+	Q_strncpyz( filename, rad_filename, sizeof( filename ) );
 
 	char* ext = strrchr( filename, '.' ) + 1;
 	strcpy( ext, "bsp" ); // rename the extension

contrib/bobtoolz/misc.cpp

@@ -39,7 +39,7 @@ char g_CurrentTexture[256] = "";
 
 void ReadCurrentTexture(){
 	const char* textureName = g_FuncTable.m_pfnGetCurrentTexture();
-	strcpy( g_CurrentTexture, textureName );
+	Q_strncpyz( g_CurrentTexture, textureName, sizeof( g_CurrentTexture ) );
 }
 
 const char*  GetCurrentTexture(){
@@ -140,7 +140,7 @@ void Sys_ERROR( const char* text, ... ){
 	char buf[32768];
 
 	va_start( argptr,text );
-	vsprintf( buf, text,argptr );
+	vsnprintf( buf, sizeof( buf ), text, argptr );
 	va_end( argptr );
 
 	Sys_FPrintf( SYS_ERR, "BobToolz::ERROR->%s", buf );
@@ -152,7 +152,7 @@ void Sys_ERROR( const char* text, ... ){
     char	buf[32768];
 
     va_start (argptr,text);
-    vsprintf (buf, text,argptr);
+    vsnprintf (buf, sizeof( buf ), text, argptr);
     va_end (argptr);
 
     g_FuncTable.m_pfnSysMsg ( buf );
@@ -248,19 +248,19 @@ bool Q_Exec( const char *pCmd, bool bCreateConsole ){
 #endif
 
 void StartBSP(){
-	char exename[256];
+	char exename[PATH_MAX];
-	GetFilename( exename, "q3map" );
+	GetFilename( exename, "q3map", sizeof( exename ) );
 	UnixToDosPath( exename ); // do we want this done in linux version?
 
 	char mapname[256];
 	const char *pn = g_FuncTable.m_pfnReadProjectKey( "mapspath" );
 
-	strcpy( mapname, pn );
+	Q_strncpyz( mapname, pn, sizeof( mapname ) );
-	strcat( mapname, "/ac_prt.map" );
+	strncat( mapname, "/ac_prt.map", sizeof( mapname ) );
 	UnixToDosPath( mapname );
 
 	char command[1024];
-	sprintf( command, "%s -nowater -fulldetail %s", exename, mapname );
+	snprintf( command, sizeof( command ), "%s -nowater -fulldetail %s", exename, mapname );
 
 	Q_Exec( command, TRUE );
 }
@@ -272,11 +272,11 @@ void BuildMiniPrt( list<Str>* exclusionList ){
 
 	DEntity world;
 
-	char buffer[128];
+	char buffer[PATH_MAX];
 	const char *pn = g_FuncTable.m_pfnReadProjectKey( "mapspath" );
 
-	strcpy( buffer, pn );
+	Q_strncpyz( buffer, pn, sizeof( buffer ) );
-	strcat( buffer, "/ac_prt.map" );
+	strncat( buffer, "/ac_prt.map", sizeof( buffer ) );
 	FILE* pFile = fopen( buffer, "w" );
 
 	// ahem, thx rr2
@@ -354,7 +354,7 @@ void FillDefaultTexture( _QERFaceData* faceData, vec3_t va, vec3_t vb, vec3_t vc
 	faceData->m_nFlags = 0;
 	faceData->m_nValue = 0;
 	if ( *texture ) {
-		strcpy( faceData->m_TextureName, texture );
+		Q_strncpyz( faceData->m_TextureName, texture, sizeof( faceData->m_TextureName ) );
 	}
 	else{
 		strcpy( faceData->m_TextureName, "textures/common/caulk" );

contrib/bobtoolz/misc.h

@@ -37,7 +37,7 @@ entity_s* FindEntityFromTargetname( const char* targetname, int* entNum );
 
 char* UnixToDosPath( char* path );
 
-char* GetFilename( char* buffer, const char* filename );
+char* GetFilename( char* buffer, const char* filename, size_t length );
 char* GetGameFilename( char* buffer, const char* filename );
 
 float Determinant3x3( float a1, float a2, float a3,

contrib/bobtoolz/shapes.cpp

@@ -574,7 +574,7 @@ void BuildDoorsX2( vec3_t min, vec3_t max,
 	srand( (unsigned)time( NULL ) );
 
 	char teamname[256];
-	sprintf( teamname, "t%i", rand() );
+	snprintf( teamname, sizeof( teamname ), "t%i", rand() );
 	/*epair_t* epDoor13 = */ GetNextChainItem( epDoor12, "team", teamname );
 	/*epair_t* epDoor23 = */ GetNextChainItem( epDoor22, "team", teamname );
 

contrib/camera/dialogs.cpp

@@ -220,10 +220,10 @@ static gint ci_apply( GtkWidget *widget, gpointer data ){
 			GetCurrentCam()->GetCam()->buildCamera();
 		}
 
-		sprintf( buf, "%.2f", GetCurrentCam()->GetCam()->getBaseTime() );
+		snprintf( buf, sizeof( buf ), "%.2f", GetCurrentCam()->GetCam()->getBaseTime() );
 		gtk_entry_set_text( GTK_ENTRY( g_pSecondsEntry ), buf );
 
-		sprintf( buf, "%.2f", GetCurrentCam()->GetCam()->getTotalTime() );
+		snprintf( buf, sizeof( buf ), "%.2f", GetCurrentCam()->GetCam()->getTotalTime() );
 		gtk_label_set_text( g_pCurrentTime, "0.00" );
 		gtk_label_set_text( g_pTotalTime, buf );
 
@@ -336,14 +336,14 @@ static void RefreshEventList( void ){
 		for ( i = 0; i < GetCurrentCam()->GetCam()->numEvents(); i++ ) {
 			char rowbuf[3][128], *row[3];
 			// FIXME: sort by time?
-			sprintf( rowbuf[0], "%li", GetCurrentCam()->GetCam()->getEvent( i )->getTime() );                 row[0] = rowbuf[0];
+			snprintf( rowbuf[0], sizeof( rowbuf[0] ), "%li", GetCurrentCam()->GetCam()->getEvent( i )->getTime() );                 row[0] = rowbuf[0];
-			strncpy( rowbuf[1], GetCurrentCam()->GetCam()->getEvent( i )->typeStr(), sizeof( rowbuf[0] ) );     row[1] = rowbuf[1];
+			Q_strncpyz( rowbuf[1], GetCurrentCam()->GetCam()->getEvent( i )->typeStr(), sizeof( rowbuf[0] ) );     row[1] = rowbuf[1];
-			strncpy( rowbuf[2], GetCurrentCam()->GetCam()->getEvent( i )->getParam(), sizeof( rowbuf[1] ) );    row[2] = rowbuf[2];
+			Q_strncpyz( rowbuf[2], GetCurrentCam()->GetCam()->getEvent( i )->getParam(), sizeof( rowbuf[1] ) );    row[2] = rowbuf[2];
 			gtk_clist_append( GTK_CLIST( g_pEventsList ), row );
 		}
 
 		// Total duration might have changed
-		sprintf( buf, "%.2f", GetCurrentCam()->GetCam()->getTotalTime() );
+		snprintf( buf, sizeof( buf ), "%.2f", GetCurrentCam()->GetCam()->getTotalTime() );
 		gtk_label_set_text( g_pCurrentTime, "0.00" );
 		gtk_label_set_text( g_pTotalTime, buf );
 
@@ -511,7 +511,7 @@ static gint ci_add_target( GtkWidget *widget, gpointer data ){
 	gtk_box_pack_start( GTK_BOX( hbox ), name, TRUE, TRUE, 0 );
 	gtk_widget_show( name );
 
-	sprintf( buf, "target%i", GetCurrentCam()->GetCam()->numTargets() + 1 );
+	snprintf( buf, sizeof( buf ), "target%i", GetCurrentCam()->GetCam()->numTargets() + 1 );
 	gtk_entry_set_text( GTK_ENTRY( name ), buf );
 
 	// -------------------------- //
@@ -721,10 +721,10 @@ static gint ci_camlist_changed( GtkWidget *widget, gpointer data ){
 			gtk_label_set_text( g_pCamType, GetCurrentCam()->GetCam()->getPositionObj()->typeStr() );
 
 			// Set duration
-			sprintf( buf, "%.2f", GetCurrentCam()->GetCam()->getBaseTime() );
+			snprintf( buf, sizeof( buf ), "%.2f", GetCurrentCam()->GetCam()->getBaseTime() );
 			gtk_entry_set_text( GTK_ENTRY( g_pSecondsEntry ), buf );
 
-			sprintf( buf, "%.2f", GetCurrentCam()->GetCam()->getTotalTime() );
+			snprintf( buf, sizeof( buf ), "%.2f", GetCurrentCam()->GetCam()->getTotalTime() );
 			gtk_label_set_text( g_pCurrentTime, "0.00" );
 			gtk_label_set_text( g_pTotalTime, buf );
 

contrib/camera/funchandlers.cpp

@@ -41,13 +41,13 @@ static void DoNewCamera( idCameraPosition::positionType type ){
 
 	if ( cam ) {
 		char buf[128];
-		sprintf( buf, "camera%i", cam->GetCamNum() );
+		snprintf( buf, sizeof( buf ), "camera%i", cam->GetCamNum() );
 
 		cam->GetCam()->startNewCamera( type );
 		cam->GetCam()->setName( buf );
 		cam->GetCam()->buildCamera();
 
-		sprintf( buf, "Unsaved Camera %i", cam->GetCamNum() );
+		snprintf( buf, sizeof( buf ), "Unsaved Camera %i", cam->GetCamNum() );
 		cam->SetFileName( buf, false );
 
 		SetCurrentCam( cam );
@@ -99,7 +99,7 @@ void DoLoadCamera(){
 		CAMERA_ExtractFilePath( firstCam->GetFileName(), basepath );
 	}
 	else{
-		strcpy( basepath, g_FuncTable.m_pfnGetGamePath() );
+		Q_strncpyz( basepath, g_FuncTable.m_pfnGetGamePath(), sizeof( basepath ) );
 	}
 
 	const gchar *filename = g_FuncTable.m_pfnFileDialog( (GtkWidget *)g_pRadiantWnd, TRUE, "Open Camera File", basepath, "camera", NULL );
@@ -117,7 +117,7 @@ void DoLoadCamera(){
 				if ( !strcmp( fullpathtofile, checkCam->GetFileName() ) ) {
 					char error[PATH_MAX + 64];
 					FreeCam( cam );
-					sprintf( error, "Camera file \'%s\' is already loaded", fullpathtofile );
+					snprintf( error, sizeof( error ), "Camera file \'%s\' is already loaded", fullpathtofile );
 					g_FuncTable.m_pfnMessageBox( (GtkWidget *)g_pRadiantWnd, error, "Load error", MB_OK, NULL );
 					//g_free( filename );
 					return;
@@ -135,7 +135,7 @@ void DoLoadCamera(){
 			else {
 				char error[PATH_MAX + 64];
 				FreeCam( cam );
-				sprintf( error, "An error occured during the loading of \'%s\'", fullpathtofile );
+				snprintf( error, sizeof( error ), "An error occured during the loading of \'%s\'", fullpathtofile );
 				g_FuncTable.m_pfnMessageBox( (GtkWidget *)g_pRadiantWnd, error, "Load error", MB_OK, NULL );
 			}
 
@@ -158,7 +158,7 @@ void DoSaveCamera() {
 		CAMERA_ExtractFilePath( GetCurrentCam()->GetFileName(), basepath );
 	}
 	else{
-		strcpy( basepath, g_FuncTable.m_pfnGetGamePath() );
+		Q_strncpyz( basepath, g_FuncTable.m_pfnGetGamePath(), sizeof( basepath ) );
 	}
 
 	const gchar *filename = g_FuncTable.m_pfnFileDialog( (void *)g_pRadiantWnd, FALSE, "Save Camera File", basepath, "camera", NULL );
@@ -171,7 +171,7 @@ void DoSaveCamera() {
 		// File dialog from windows (and maybe the gtk one from radiant) doesn't handle default extensions properly.
 		// Add extension and check again if file exists
 		if ( strcmp( fullpathtofile + ( strlen( fullpathtofile ) - 7 ), ".camera" ) ) {
-			strcat( fullpathtofile, ".camera" );
+			strncat( fullpathtofile, ".camera", sizeof( fullpathtofile ) );
 
 			if ( FileExists( fullpathtofile ) ) {
 				if ( g_FuncTable.m_pfnMessageBox( (GtkWidget *)g_pRadiantWnd, "File already exists.\nOverwrite?", "Save Camera File", MB_YESNO, NULL ) == IDNO ) {
@@ -191,7 +191,7 @@ void DoSaveCamera() {
 			}
 			else if ( !strcmp( fullpathtofile, checkCam->GetFileName() ) ) {
 				char error[PATH_MAX + 64];
-				sprintf( error, "Camera file \'%s\' is currently loaded by GtkRadiant.\nPlease select a different filename.", fullpathtofile );
+				snprintf( error, sizeof( error ), "Camera file \'%s\' is currently loaded by GtkRadiant.\nPlease select a different filename.", fullpathtofile );
 				g_FuncTable.m_pfnMessageBox( (GtkWidget *)g_pRadiantWnd, error, "Save error", MB_OK, NULL );
 				return;
 			}
@@ -213,14 +213,14 @@ void DoUnloadCamera() {
 
 	if ( !GetCurrentCam()->HasBeenSaved() ) {
 		char buf[PATH_MAX + 64];
-		sprintf( buf, "Do you want to save the changes for camera '%s'?", GetCurrentCam()->GetCam()->getName() );
+		snprintf( buf, sizeof( buf ), "Do you want to save the changes for camera '%s'?", GetCurrentCam()->GetCam()->getName() );
 		if ( g_FuncTable.m_pfnMessageBox( (GtkWidget *)g_pRadiantWnd, buf, "Warning", MB_YESNO, NULL ) == IDYES ) {
 			DoSaveCamera();
 		}
 	}
 	else if ( GetCurrentCam()->HasBeenSaved() == 2 ) {
 		char buf[PATH_MAX + 64];
-		sprintf( buf, "Do you want to save the changes made to camera file '%s'?", GetCurrentCam()->GetFileName() );
+		snprintf( buf, sizeof( buf ), "Do you want to save the changes made to camera file '%s'?", GetCurrentCam()->GetFileName() );
 		if ( g_FuncTable.m_pfnMessageBox( (GtkWidget *)g_pRadiantWnd, buf, "Warning", MB_YESNO, NULL ) == IDYES ) {
 			DoSaveCamera();
 		}

contrib/camera/misc.cpp

@@ -31,7 +31,7 @@ void Sys_ERROR( char* text, ... ){
 	char buf[32768];
 
 	va_start( argptr,text );
-	vsprintf( buf, text,argptr );
+	vsnprintf( buf, sizeof( buf ), text, argptr );
 	va_end( argptr );
 
 	Sys_FPrintf( SYS_ERR, "Camera::ERROR->%s", buf );
@@ -114,7 +114,7 @@ void CDECL Com_Error( int level, const char *error, ... ){
 	char buf[32768];
 
 	va_start( argptr,error );
-	vsprintf( buf, error,argptr );
+	vsnprintf( buf, sizeof( buf ), error, argptr );
 	va_end( argptr );
 
 	Sys_FPrintf( SYS_ERR, "Camera::ERROR->%s", buf );
@@ -125,7 +125,7 @@ void CDECL Com_Printf( const char* msg, ... ){
 	char buf[32768];
 
 	va_start( argptr,msg );
-	vsprintf( buf, msg,argptr );
+	vsnprintf( buf, sizeof( buf ), msg, argptr );
 	va_end( argptr );
 
 	Sys_Printf( "Camera::%s", buf );
@@ -137,7 +137,7 @@ void CDECL Com_DPrintf( const char* msg, ... ){
 	char buf[32768];
 
 	va_start( argptr,msg );
-	vsprintf( buf, msg,argptr );
+	vsnprintf( buf, sizeof( buf ), msg, argptr );
 	va_end( argptr );
 
 	Sys_Printf( "Camera::%s", buf );

contrib/gtkgensurf/bitmap.cpp

@@ -442,7 +442,7 @@ bool OpenBitmap(){
 		g_print( "failed to load file gbmp %s\n",gbmp.name );
 		char Text[256];
 
-		sprintf( Text, "Error opening %s", gbmp.name );
+		snprintf( Text, sizeof( Text ), "Error opening %s", gbmp.name );
 		g_FuncTable.m_pfnMessageBox( g_pWnd, Text, "Bitmap", MB_ICONEXCLAMATION, NULL );
 		strcpy( gbmp.name, "" );
 	}

contrib/gtkgensurf/dec.cpp

@@ -1015,8 +1015,8 @@ void MakeBrushes( int NumTris, NODE *Node, TRI *Tri,bool surf,
 
 		for ( j = 0; j < 5; j++ )
 		{
-			strcpy( brush.face[j].texture,
+			Q_strncpyz( brush.face[j].texture,
-					( strlen( texture1 ) ? texture1 : texture0 ) );
+					( strlen( texture1 ) ? texture1 : texture0 ), sizeof( brush.face[j].texture ) );
 			brush.face[j].Shift[0] = (float)TexOffset[0];
 			brush.face[j].Shift[1] = (float)TexOffset[1];
 			brush.face[j].Rotate   = 0.;
@@ -1038,14 +1038,14 @@ void MakeBrushes( int NumTris, NODE *Node, TRI *Tri,bool surf,
 			CrossProduct( t[0],t[1],SurfNormal );
 			VectorNormalize( SurfNormal,SurfNormal );
 			if ( DotProduct( SurfNormal,PlaneNormal ) < Steep ) {
-				strcpy( brush.face[0].texture,texture2 );
+				Q_strncpyz( brush.face[0].texture, texture2, sizeof( brush.face[0].texture ) );
 			}
 			else{
-				strcpy( brush.face[0].texture,texture0 );
+				Q_strncpyz( brush.face[0].texture, texture0, sizeof( brush.face[0].texture ) );
 			}
 		}
 		else{
-			strcpy( brush.face[0].texture,texture0 );
+			Q_strncpyz( brush.face[0].texture, texture0, sizeof( brush.face[0].texture ) );
 		}
 
 		if ( surf ) {
@@ -1364,7 +1364,7 @@ void MapOut( int NumNodes,int NumTris, NODE *Node, TRI *Tri ){
 						} // switch (Plane)
 						for ( face = 0; face < 6; face++ )
 						{
-							strcpy( brush.face[face].texture,( face <= 1 ? skip : hint ) );
+							Q_strncpyz( brush.face[face].texture,( face <= 1 ? skip : hint ), sizeof( brush.face[face].texture ) );
 							brush.face[face].Shift[0] = 0;
 							brush.face[face].Shift[1] = 0;
 							brush.face[face].Rotate   = 0.;

contrib/gtkgensurf/face.cpp

@@ -359,7 +359,7 @@ void UseFaceBounds(){
 			BestDot  = Dot;
 			BestFace = i;
 			if ( strlen( QERFaceData->m_TextureName ) ) {
-				strcpy( Texture[Game][0],QERFaceData->m_TextureName );
+				Q_strncpyz( Texture[Game][0], QERFaceData->m_TextureName, sizeof( Texture[Game][0] ) );
 			}
 		}
 	}
@@ -371,7 +371,7 @@ void UseFaceBounds(){
 		QERFaceData = g_FuncTable.m_pfnGetFaceData( vp,i );
 		if ( strlen( QERFaceData->m_TextureName ) ) {
 			if ( strcmp( Texture[Game][0], QERFaceData->m_TextureName ) ) {
-				strcpy( Texture[Game][1],QERFaceData->m_TextureName );
+				Q_strncpyz( Texture[Game][1], QERFaceData->m_TextureName, sizeof( Texture[Game][1] ) );
 			}
 		}
 	}

contrib/gtkgensurf/gendlgs.cpp

@@ -281,32 +281,32 @@ static void SetDlgValues( int tab ){
 		gtk_toggle_button_set_active( GTK_TOGGLE_BUTTON( wave_radios[WaveType] ), TRUE );
 		gtk_spin_button_set_value( GTK_SPIN_BUTTON( g_object_get_data( G_OBJECT( g_pWnd ), "random" ) ),
 								   RandomSeed );
-		sprintf( Text, RForm, WaveLength );
+		snprintf( Text, sizeof( Text ), RForm, WaveLength );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "wavelength" ) ), Text );
-		sprintf( Text, RForm, Amplitude );
+		snprintf( Text, sizeof( Text ), RForm, Amplitude );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "amplitude" ) ), Text );
-		sprintf( Text, RForm, Roughness );
+		snprintf( Text, sizeof( Text ), RForm, Roughness );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "roughness" ) ), Text );
 		gtk_toggle_button_set_active( GTK_TOGGLE_BUTTON( g_object_get_data
 															 ( G_OBJECT( g_pWnd ), "main_antialiasing" ) ), Antialiasing );
 		break;
 
 	case EXTENTS_TAB:
-		sprintf( Text,RForm,Hll );
+		snprintf( Text, sizeof( Text ), RForm, Hll );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "hmin" ) ), Text );
-		sprintf( Text,RForm,Vll );
+		snprintf( Text, sizeof( Text ), RForm, Vll );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "vmin" ) ), Text );
-		sprintf( Text,RForm,Hur );
+		snprintf( Text, sizeof( Text ), RForm, Hur );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "hmax" ) ), Text );
-		sprintf( Text,RForm,Vur );
+		snprintf( Text, sizeof( Text ), RForm, Vur );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "vmax" ) ), Text );
-		sprintf( Text,RForm,Z00 );
+		snprintf( Text, sizeof( Text ), RForm, Z00 );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "z00" ) ), Text );
-		sprintf( Text,RForm,Z01 );
+		snprintf( Text, sizeof( Text ), RForm, Z01 );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "z01" ) ), Text );
-		sprintf( Text,RForm,Z10 );
+		snprintf( Text, sizeof( Text ), RForm, Z10 );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "z10" ) ), Text );
-		sprintf( Text,RForm,Z11 );
+		snprintf( Text, sizeof( Text ), RForm, Z11 );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "z11" ) ), Text );
 		gtk_spin_button_set_value( GTK_SPIN_BUTTON( g_object_get_data( G_OBJECT( g_pWnd ), "nh" ) ), NH );
 		gtk_spin_button_set_value( GTK_SPIN_BUTTON( g_object_get_data( G_OBJECT( g_pWnd ), "nv" ) ), NV );
@@ -386,9 +386,9 @@ static void SetDlgValues( int tab ){
 
 	case BITMAP_TAB:
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "bmp_file" ) ), gbmp.name );
-		sprintf( Text,"%g",gbmp.black_value );
+		snprintf( Text, sizeof( Text ), "%g", gbmp.black_value );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "bmp_black" ) ), Text );
-		sprintf( Text,"%g",gbmp.white_value );
+		snprintf( Text, sizeof( Text ), "%g", gbmp.white_value );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "bmp_white" ) ), Text );
 		break;
 
@@ -401,13 +401,13 @@ static void SetDlgValues( int tab ){
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "texture3" ) ), Texture[Game][2] );
 		gtk_spin_button_set_value( GTK_SPIN_BUTTON( g_object_get_data( G_OBJECT( g_pWnd ), "tex_slant" ) ),
 								   SlantAngle );
-		sprintf( Text,RForm,TexOffset[0] );
+		snprintf( Text, sizeof( Text ), RForm, TexOffset[0] );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "texoffsetx" ) ), Text );
-		sprintf( Text,RForm,TexOffset[1] );
+		snprintf( Text, sizeof( Text ), RForm, TexOffset[1] );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "texoffsety" ) ), Text );
-		sprintf( Text,RForm,TexScale[0] );
+		snprintf( Text, sizeof( Text ), RForm, TexScale[0] );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "texscalex" ) ), Text );
-		sprintf( Text,RForm,TexScale[1] );
+		snprintf( Text, sizeof( Text ), RForm, TexScale[1] );
 		gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "texscaley" ) ), Text );
 		CHECK_WIDGET( "detail", UseDetail );
 
@@ -727,14 +727,14 @@ static void main_go( GtkWidget *widget, gpointer data ){
 
 	ReadDlgValues( current_tab );
 	if ( NH < 1 || NH > MAX_ROWS ) {
-		sprintf( Text, "The number of divisions must be > 0 and no greater than %d.", MAX_ROWS );
+		snprintf( Text, sizeof( Text ), _( "The number of divisions must be > 0 and no greater than %d." ), MAX_ROWS );
 		g_FuncTable.m_pfnMessageBox( g_pWnd, Text, "GenSurf", MB_ICONEXCLAMATION, NULL );
 		gtk_notebook_set_page( GTK_NOTEBOOK( notebook ), EXTENTS_TAB );
 		return;
 	}
 
 	if ( NV < 1 || NV > MAX_ROWS ) {
-		sprintf( Text, "The number of divisions must be > 0 and no greater than %d.", MAX_ROWS );
+		snprintf( Text, sizeof( Text ), _( "The number of divisions must be > 0 and no greater than %d." ), MAX_ROWS );
 		g_FuncTable.m_pfnMessageBox( g_pWnd, Text, "GenSurf", MB_ICONEXCLAMATION, NULL );
 		gtk_notebook_set_page( GTK_NOTEBOOK( notebook ), EXTENTS_TAB );
 		return;
@@ -883,9 +883,9 @@ static void extents_snaptogrid_spin( GtkAdjustment *adj, int *data ){
 static gint bitmap_file_entryfocusout( GtkWidget* widget, GdkEventFocus* event, gpointer data ){
 	char filename[NAME_MAX];
 
-	strcpy( filename, gtk_entry_get_text( GTK_ENTRY( widget ) ) );
+	Q_strncpyz( filename, gtk_entry_get_text( GTK_ENTRY( widget ) ), sizeof( filename ) );
 	if ( strcmp( filename,gbmp.name ) ) {
-		strcpy( gbmp.name,filename );
+		Q_strncpyz( gbmp.name, filename, sizeof( gbmp.name ) );
 		if ( strlen( gbmp.name ) ) {
 			OpenBitmap();
 		}
@@ -901,12 +901,12 @@ static void bitmap_browse( GtkWidget *widget, gpointer data ){
 	filename = g_FuncTable.m_pfnFileDialog( g_pWnd, TRUE, "Bitmap File", gbmp.defpath, "gtkgensurf", NULL );
 
 	if ( filename != NULL ) {
-		strcpy( gbmp.name, filename );
+		Q_strncpyz( gbmp.name, filename, sizeof( gbmp.name ) );
 
 		ptr = (char *) strrchr( filename, G_DIR_SEPARATOR );
 		if ( ptr != NULL ) {
 			*( ptr + 1 ) = '\0';
-			strcpy( gbmp.defpath, filename );
+			Q_strncpyz( gbmp.defpath, filename, sizeof( gbmp.defpath ) );
 		}
 
 		OpenBitmap();
@@ -915,7 +915,7 @@ static void bitmap_browse( GtkWidget *widget, gpointer data ){
 }
 
 static void bitmap_reload( GtkWidget *widget, gpointer data ){
-	strcpy( gbmp.name, gtk_entry_get_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "bmp_file" ) ) ) );
+	Q_strncpyz( gbmp.name, gtk_entry_get_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "bmp_file" ) ) ), sizeof( gbmp.name ) );
 	if ( strlen( gbmp.name ) ) {
 		OpenBitmap();
 		ENABLE_WIDGET( "go", ( gbmp.colors != NULL ? TRUE : FALSE ) );
@@ -936,7 +936,7 @@ static gint fix_value_entryfocusout( GtkWidget* widget, GdkEventFocus *event, gp
 		gdk_beep();
 		g_FuncTable.m_pfnMessageBox( g_pWnd, "The value must be between -65536 and 65536, inclusive.",
 									 "GenSurf", MB_OK | MB_ICONEXCLAMATION, NULL );
-		sprintf( Text, "%d", (int)xyz[Vertex[0].i][Vertex[0].j].fixed_value );
+		snprintf( Text, sizeof( Text ), "%d", (int)xyz[Vertex[0].i][Vertex[0].j].fixed_value );
 		gtk_entry_set_text( GTK_ENTRY( widget ), Text );
 		gtk_window_set_focus( GTK_WINDOW( gtk_widget_get_toplevel( widget ) ), widget );
 	}
@@ -1006,7 +1006,7 @@ static void fix_freeall( GtkWidget *widget, gpointer data ){
 }
 
 void vertex_selected(){
-	char Text[32];
+	char Text[64];
 	int k;
 
 	SetupControls();
@@ -1032,9 +1032,9 @@ void vertex_selected(){
 	gtk_spin_button_set_value( GTK_SPIN_BUTTON( g_object_get_data( G_OBJECT( g_pWnd ), "fix_value" ) ),
 							   (int)xyz[Vertex[0].i][Vertex[0].j].fixed_value );
 
-	sprintf( Text,"%d",(int)xyz[Vertex[0].i][Vertex[0].j].range );
+	snprintf( Text, sizeof( Text ), "%d", (int)xyz[Vertex[0].i][Vertex[0].j].range );
 	gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "fix_range" ) ), Text );
-	sprintf( Text,"%.5g",xyz[Vertex[0].i][Vertex[0].j].rate );
+	snprintf( Text, sizeof( Text ), "%.5g", xyz[Vertex[0].i][Vertex[0].j].rate );
 	gtk_entry_set_text( GTK_ENTRY( g_object_get_data( G_OBJECT( g_pWnd ), "fix_rate" ) ), Text );
 
 	for ( k = 0; k < NumVerticesSelected; k++ )
@@ -1071,7 +1071,7 @@ static void texture_terrainent( GtkToggleButton *check, gpointer data ){
 }
 
 static void texture_set( int index, const char* name ){
-	strcpy( Texture[Game][index], name );
+	Q_strncpyz( Texture[Game][index], name, sizeof( Texture[Game][index] ) );
 }
 
 static gint texture_entryfocusout( GtkWidget* widget, GdkEventFocus* event, gpointer data ){
@@ -2230,8 +2230,8 @@ qboolean CALLBACK AboutDlgProc( HWND hwnd, unsigned msg, UINT wparam, LONG lpara
 
 	switch ( msg ) {
 	case WM_INITDIALOG:
-		strcpy( szText,"About " );
+		Q_strncpyz( szText, "About ", sizeof( szText ) );
-		strcat( szText,gszCaption );
+		strncat( szText, gszCaption, sizeof( szText ) );
 		SetWindowText( hwnd,gszCaption );
 		SetDlgItemText( hwnd,DLG_ABOUT_APP,szText );
 		/*	Application icon: */
@@ -2315,7 +2315,7 @@ qboolean CALLBACK AboutDlgProc( HWND hwnd, unsigned msg, UINT wparam, LONG lpara
 void About(){
 	if ( DialogBox( ghInst,"About", ghwnd_main, (DLGPROC)AboutDlgProc ) < 0 ) {
 		char Text[256];
-		sprintf( Text,"In About(), GetLastError()=0x%08x",GetLastError() );
+		snprintf( Text, sizeof( Text ),"In About(), GetLastError()=0x%08x",GetLastError() );
 		MessageBox( ghwnd_main,Text,"GenSurf",MB_ICONEXCLAMATION );
 	}
 }

contrib/gtkgensurf/genmap.cpp

@@ -192,7 +192,7 @@ int MapPatches(){
 			NH_patch -= 2;
 		NH_remain -= ( NH_patch - 1 );
 		if ( NH_remain < 0 ) {
-			sprintf( szOops,"Oops... screwed up with NH=%d",NH );
+			snprintf( szOops, sizeof( szOops ), "Oops... screwed up with NH=%d", NH );
 			g_FuncTable.m_pfnMessageBox( NULL,szOops,"Uh oh", 0, NULL );
 		}
 		NV_remain = NV + 1;
@@ -233,7 +233,7 @@ int MapPatches(){
 				NV_patch -= 2;
 			NV_remain -= ( NV_patch - 1 );
 			if ( NV_remain < 0 ) {
-				sprintf( szOops,"Oops... screwed up with NV=%d",NV );
+				snprintf( szOops, sizeof( szOops ), "Oops... screwed up with NV=%d", NV );
 				g_FuncTable.m_pfnMessageBox( NULL,szOops,"Uh oh", 0, NULL );
 			}
 
@@ -287,9 +287,9 @@ void MapBrushes(){
 	BRUSH brush;
 	XYZ v[8];
 
-	strcpy( surftext,Texture[Game][0] );
+	Q_strncpyz( surftext, Texture[Game][0], sizeof( surftext ) );
-	strcpy( sidetext,( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ) );
+	Q_strncpyz( sidetext,( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ), sizeof( sidetext ) );
-	strcpy( surftext2,( strlen( Texture[Game][2] ) ? Texture[Game][2] : Texture[Game][0] ) );
+	Q_strncpyz( surftext2,( strlen( Texture[Game][2] ) ? Texture[Game][2] : Texture[Game][0] ), sizeof( surftext2 )  );
 
 	// if surftext2 is identical to surftext, there's no need to
 	// check surface angle
@@ -376,8 +376,8 @@ void MapBrushes(){
 			XYZtoV( &v[0],&brush.face[0].v[0] );
 			XYZtoV( &v[3],&brush.face[0].v[1] );
 			XYZtoV( &v[4],&brush.face[0].v[2] );
-			strcpy( brush.face[0].texture,
+			Q_strncpyz( brush.face[0].texture,
-					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ) );
+					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ), sizeof( brush.face[0].texture ) );
 			brush.face[0].Shift[0] = (float)TexOffset[0];
 			brush.face[0].Shift[1] = (float)TexOffset[1];
 			brush.face[0].Rotate   = 0.;
@@ -390,8 +390,8 @@ void MapBrushes(){
 			XYZtoV( &v[1],&brush.face[1].v[0] );
 			XYZtoV( &v[4],&brush.face[1].v[1] );
 			XYZtoV( &v[5],&brush.face[1].v[2] );
-			strcpy( brush.face[1].texture,
+			Q_strncpyz( brush.face[1].texture,
-					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ) );
+					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ), sizeof( brush.face[1].texture ) );
 			brush.face[1].Shift[0] = (float)TexOffset[0];
 			brush.face[1].Shift[1] = (float)TexOffset[1];
 			brush.face[1].Rotate   = 0.;
@@ -404,8 +404,8 @@ void MapBrushes(){
 			XYZtoV( &v[2],&brush.face[2].v[0] );
 			XYZtoV( &v[5],&brush.face[2].v[1] );
 			XYZtoV( &v[3],&brush.face[2].v[2] );
-			strcpy( brush.face[2].texture,
+			Q_strncpyz( brush.face[2].texture,
-					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ) );
+					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ), sizeof( brush.face[2].texture ) );
 			brush.face[2].Shift[0] = (float)TexOffset[0];
 			brush.face[2].Shift[1] = (float)TexOffset[1];
 			brush.face[2].Rotate   = 0.;
@@ -426,21 +426,21 @@ void MapBrushes(){
 				}
 				else
 				{
-					strcpy( surft,surftext );
+					Q_strncpyz( surft, surftext, sizeof( surft ) );
 					surf = surface[0];
 				}
 			}
 			else
 			{
-				strcpy( surft,surftext );
+				Q_strncpyz( surft, surftext, sizeof( surft ) );
 				surf = surface[0];
 			}
 
 			XYZtoV( &v[3],&brush.face[3].v[0] );
 			XYZtoV( &v[5],&brush.face[3].v[1] );
 			XYZtoV( &v[4],&brush.face[3].v[2] );
-			strcpy( brush.face[3].texture,
+			Q_strncpyz( brush.face[3].texture,
-					( Plane == PLANE_XZ0 || Plane == PLANE_XZ1 ? surft : sidetext ) );
+					( Plane == PLANE_XZ0 || Plane == PLANE_XZ1 ? surft : sidetext ), sizeof( brush.face[3].texture ) );
 			brush.face[3].Shift[0] = (float)TexOffset[0];
 			brush.face[3].Shift[1] = (float)TexOffset[1];
 			brush.face[3].Rotate   = 0.;
@@ -461,21 +461,21 @@ void MapBrushes(){
 				}
 				else
 				{
-					strcpy( surft,surftext );
+					Q_strncpyz( surft, surftext, sizeof( surft ) );
 					surf = surface[0];
 				}
 			}
 			else
 			{
-				strcpy( surft,surftext );
+				Q_strncpyz( surft, surftext, sizeof( surft ) );
 				surf = surface[0];
 			}
 
 			XYZtoV( &v[0],&brush.face[4].v[0] );
 			XYZtoV( &v[1],&brush.face[4].v[1] );
 			XYZtoV( &v[2],&brush.face[4].v[2] );
-			strcpy( brush.face[4].texture,
+			Q_strncpyz( brush.face[4].texture,
-					( Plane == PLANE_XZ0 || Plane == PLANE_XZ1 ? sidetext : surft ) );
+					( Plane == PLANE_XZ0 || Plane == PLANE_XZ1 ? sidetext : surft ), sizeof( brush.face[4].texture ) );
 			brush.face[4].Shift[0] = (float)TexOffset[0];
 			brush.face[4].Shift[1] = (float)TexOffset[1];
 			brush.face[4].Rotate   = 0.;
@@ -544,8 +544,8 @@ void MapBrushes(){
 			XYZtoV( &v[0],&brush.face[0].v[0] );
 			XYZtoV( &v[3],&brush.face[0].v[1] );
 			XYZtoV( &v[4],&brush.face[0].v[2] );
-			strcpy( brush.face[0].texture,
+			Q_strncpyz( brush.face[0].texture,
-					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ) );
+					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ), sizeof( brush.face[0].texture ) );
 			brush.face[0].Shift[0] = (float)TexOffset[0];
 			brush.face[0].Shift[1] = (float)TexOffset[1];
 			brush.face[0].Rotate   = 0.;
@@ -558,8 +558,8 @@ void MapBrushes(){
 			XYZtoV( &v[1],&brush.face[1].v[0] );
 			XYZtoV( &v[4],&brush.face[1].v[1] );
 			XYZtoV( &v[5],&brush.face[1].v[2] );
-			strcpy( brush.face[1].texture,
+			Q_strncpyz( brush.face[1].texture,
-					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ) );
+					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ), sizeof( brush.face[1].texture ) );
 			brush.face[1].Shift[0] = (float)TexOffset[0];
 			brush.face[1].Shift[1] = (float)TexOffset[1];
 			brush.face[1].Rotate   = 0.;
@@ -572,8 +572,8 @@ void MapBrushes(){
 			XYZtoV( &v[2],&brush.face[2].v[0] );
 			XYZtoV( &v[5],&brush.face[2].v[1] );
 			XYZtoV( &v[3],&brush.face[2].v[2] );
-			strcpy( brush.face[2].texture,
+			Q_strncpyz( brush.face[2].texture,
-					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ) );
+					( strlen( Texture[Game][1] ) ? Texture[Game][1] : Texture[Game][0] ), sizeof( brush.face[2].texture ) );
 			brush.face[2].Shift[0] = (float)TexOffset[0];
 			brush.face[2].Shift[1] = (float)TexOffset[1];
 			brush.face[2].Rotate   = 0.;
@@ -594,20 +594,20 @@ void MapBrushes(){
 				}
 				else
 				{
-					strcpy( surft,surftext );
+					Q_strncpyz( surft, surftext, sizeof( surft ) );
 					surf = surface[0];
 				}
 			}
 			else
 			{
-				strcpy( surft,surftext );
+				Q_strncpyz( surft, surftext, sizeof( surft ) );
 				surf = surface[0];
 			}
 			XYZtoV( &v[3],&brush.face[3].v[0] );
 			XYZtoV( &v[5],&brush.face[3].v[1] );
 			XYZtoV( &v[4],&brush.face[3].v[2] );
-			strcpy( brush.face[3].texture,
+			Q_strncpyz( brush.face[3].texture,
-					( Plane == PLANE_XZ0 || Plane == PLANE_XZ1 ? surft : sidetext ) );
+					( Plane == PLANE_XZ0 || Plane == PLANE_XZ1 ? surft : sidetext ), sizeof( brush.face[3].texture ) );
 			brush.face[3].Shift[0] = (float)TexOffset[0];
 			brush.face[3].Shift[1] = (float)TexOffset[1];
 			brush.face[3].Rotate   = 0.;
@@ -623,25 +623,25 @@ void MapBrushes(){
 				CrossProduct( t[0],t[1],SurfNormal );
 				VectorNormalize( SurfNormal,SurfNormal );
 				if ( DotProduct( SurfNormal,PlaneNormal ) < Steep ) {
-					strcpy( surft,surftext2 );
+					Q_strncpyz( surft, surftext2, sizeof( surft ) );
 					surf = surface[2];
 				}
 				else
 				{
-					strcpy( surft,surftext );
+					Q_strncpyz( surft, surftext, sizeof( surft ) );
 					surf = surface[0];
 				}
 			}
 			else
 			{
-				strcpy( surft,surftext );
+				Q_strncpyz( surft, surftext, sizeof( surft ) );
 				surf = surface[0];
 			}
 			XYZtoV( &v[0],&brush.face[4].v[0] );
 			XYZtoV( &v[1],&brush.face[4].v[1] );
 			XYZtoV( &v[2],&brush.face[4].v[2] );
-			strcpy( brush.face[4].texture,
+			Q_strncpyz( brush.face[4].texture,
-					( Plane == PLANE_XZ0 || Plane == PLANE_XZ1 ? sidetext : surft ) );
+					( Plane == PLANE_XZ0 || Plane == PLANE_XZ1 ? sidetext : surft ), sizeof( brush.face[4].texture ) );
 			brush.face[4].Shift[0] = (float)TexOffset[0];
 			brush.face[4].Shift[1] = (float)TexOffset[1];
 			brush.face[4].Rotate   = 0.;
@@ -806,7 +806,7 @@ void MapBrushes(){
 					XYZtoV( &v[0],&brush.face[0].v[0] );
 					XYZtoV( &v[1],&brush.face[0].v[1] );
 					XYZtoV( &v[2],&brush.face[0].v[2] );
-					strcpy( brush.face[0].texture,skip );
+					Q_strncpyz( brush.face[0].texture, skip, sizeof( brush.face[0].texture ) );
 					brush.face[0].Shift[0] = 0.;
 					brush.face[0].Shift[1] = 0.;
 					brush.face[0].Rotate   = 0.;
@@ -819,7 +819,7 @@ void MapBrushes(){
 					XYZtoV( &v[4],&brush.face[1].v[0] );
 					XYZtoV( &v[7],&brush.face[1].v[1] );
 					XYZtoV( &v[6],&brush.face[1].v[2] );
-					strcpy( brush.face[1].texture,skip );
+					Q_strncpyz( brush.face[1].texture, skip, sizeof( brush.face[1].texture ) );
 					brush.face[1].Shift[0] = 0.;
 					brush.face[1].Shift[1] = 0.;
 					brush.face[1].Rotate   = 0.;
@@ -832,7 +832,7 @@ void MapBrushes(){
 					XYZtoV( &v[0],&brush.face[2].v[0] );
 					XYZtoV( &v[4],&brush.face[2].v[1] );
 					XYZtoV( &v[5],&brush.face[2].v[2] );
-					strcpy( brush.face[2].texture,hint );
+					Q_strncpyz( brush.face[2].texture, hint, sizeof( brush.face[2].texture ) );
 					brush.face[2].Shift[0] = 0.;
 					brush.face[2].Shift[1] = 0.;
 					brush.face[2].Rotate   = 0.;
@@ -845,7 +845,7 @@ void MapBrushes(){
 					XYZtoV( &v[1],&brush.face[3].v[0] );
 					XYZtoV( &v[5],&brush.face[3].v[1] );
 					XYZtoV( &v[6],&brush.face[3].v[2] );
-					strcpy( brush.face[3].texture,hint );
+					Q_strncpyz( brush.face[3].texture, hint, sizeof( brush.face[3].texture ) );
 					brush.face[3].Shift[0] = 0.;
 					brush.face[3].Shift[1] = 0.;
 					brush.face[3].Rotate   = 0.;
@@ -858,7 +858,7 @@ void MapBrushes(){
 					XYZtoV( &v[2],&brush.face[4].v[0] );
 					XYZtoV( &v[6],&brush.face[4].v[1] );
 					XYZtoV( &v[7],&brush.face[4].v[2] );
-					strcpy( brush.face[4].texture,hint );
+					Q_strncpyz( brush.face[4].texture, hint, sizeof( brush.face[4].texture ) );
 					brush.face[4].Shift[0] = 0.;
 					brush.face[4].Shift[1] = 0.;
 					brush.face[4].Rotate   = 0.;
@@ -871,7 +871,7 @@ void MapBrushes(){
 					XYZtoV( &v[3],&brush.face[5].v[0] );
 					XYZtoV( &v[7],&brush.face[5].v[1] );
 					XYZtoV( &v[4],&brush.face[5].v[2] );
-					strcpy( brush.face[5].texture,hint );
+					Q_strncpyz( brush.face[5].texture, hint, sizeof( brush.face[5].texture ) );
 					brush.face[5].Shift[0] = 0.;
 					brush.face[5].Shift[1] = 0.;
 					brush.face[5].Rotate   = 0.;
@@ -892,7 +892,7 @@ void MapBrushes(){
 			brush.NumFaces = 5;
 			for ( i = 0; i < 6; i++ )
 			{
-				strcpy( brush.face[i].texture,hint );
+				Q_strncpyz( brush.face[i].texture, hint, sizeof( brush.face[i].texture ) );
 				brush.face[i].Shift[0] = 0.;
 				brush.face[i].Shift[1] = 0.;
 				brush.face[i].Rotate   = 0.;
@@ -2015,7 +2015,7 @@ void MakePatch( patchMesh_t *p ){
 	ret = g_FuncTable.m_pfnCreatePatchHandle();
 	// strcpy(shadername, "textures/");
 	// strcpy(shadername+9, Texture[Game][0]);
-	strcpy( shadername, Texture[Game][0] );
+	Q_strncpyz( shadername, Texture[Game][0], sizeof( shadername ) );
 	g_FuncTable.m_pfnCommitPatchHandleToMap( ret,p,shadername );
 	g_FuncTable.m_pfnReleasePatchHandles();
 }
@@ -2037,12 +2037,12 @@ void MakeBrush( BRUSH *brush ){
 	for ( i = 0; i < brush->NumFaces; i++ )
 	{
 		if ( !strncmp( brush->face[i].texture, "textures/", 9 ) ) {
-			strcpy( QERFaceData.m_TextureName,brush->face[i].texture );
+			Q_strncpyz( QERFaceData.m_TextureName, brush->face[i].texture, sizeof( QERFaceData.m_TextureName ) );
 		}
 		else
 		{
 			strcpy( QERFaceData.m_TextureName, "textures/" );
-			strcpy( QERFaceData.m_TextureName + 9,brush->face[i].texture );
+			Q_strncpyz( QERFaceData.m_TextureName + 9,brush->face[i].texture, sizeof( QERFaceData.m_TextureName ) - 9 );
 		}
 		QERFaceData.m_nContents = brush->face[i].Contents;
 		QERFaceData.m_nFlags    = brush->face[i].Surface;

contrib/gtkgensurf/gensurf.cpp

@@ -100,15 +100,15 @@ char GameName[NUMGAMES][16] = {"Quake2", "Half-Life", "SiN", "Heretic2", "Kingpi
 
 
 bool GenSurfInit(){
-	strcpy( gszVersion, "1.05" );
+	Q_strncpyz( gszVersion, "1.05", sizeof( gszVersion ) );
-	strcpy( gszCaption, "GtkGenSurf" );
+	Q_strncpyz( gszCaption, "GtkGenSurf", sizeof( gszCaption ) );
 	if ( strlen( gszVersion ) ) {
-		strcat( gszCaption, " v" );
+		strncat( gszCaption, " v", sizeof( gszCaption ) );
-		strcat( gszCaption, gszVersion );
+		strncat( gszCaption, gszVersion, sizeof( gszCaption ) );
 	}
 
-	strcpy( gszIni, g_FuncTable.m_pfnProfileGetDirectory() );
+	Q_strncpyz( gszIni, g_FuncTable.m_pfnProfileGetDirectory(), sizeof( gszIni ) );
-	strcat( gszIni, "gensurf.ini" );
+	strncat( gszIni, "gensurf.ini", sizeof( gszIni ) );
 
 /*if (g_FuncTable.m_pfnReadProjectKey != NULL)
    {
@@ -273,9 +273,9 @@ void ReadIniFile( const char *file ){
 	for ( i = 0; i < NUMGAMES; i++ )
 	{
 		//    strcpy (gszOutputDir[i], g_FuncTable.m_pfnProfileLoadString (file, GameName[i],"OutputDir",""));
-		strcpy( Texture[i][0], g_FuncTable.m_pfnProfileLoadString( file, GameName[i], "Texture", "" ) );
+		Q_strncpyz( Texture[i][0], g_FuncTable.m_pfnProfileLoadString( file, GameName[i], "Texture", "" ), sizeof( Texture[i][0] ) );
-		strcpy( Texture[i][1], g_FuncTable.m_pfnProfileLoadString( file, GameName[i], "Texture2", "" ) );
+		Q_strncpyz( Texture[i][1], g_FuncTable.m_pfnProfileLoadString( file, GameName[i], "Texture2", "" ), sizeof( Texture[i][1] ) );
-		strcpy( Texture[i][2], g_FuncTable.m_pfnProfileLoadString( file, GameName[i], "Texture3", "" ) );
+		Q_strncpyz( Texture[i][2], g_FuncTable.m_pfnProfileLoadString( file, GameName[i], "Texture3", "" ), sizeof( Texture[i][2] ) );
 		//    strcpy (gszTextureDir[i], g_FuncTable.m_pfnProfileLoadString (file, GameName[i],"TextureDir",""));
 		//    UsePak[i] = GetPrivateProfileInt(GameName[i],"UsePak",0);
 		//    strcpy (pakfile[i], g_FuncTable.m_pfnProfileLoadString (file, GameName[i],"PakFile",""));
@@ -312,7 +312,7 @@ void ReadIniFile( const char *file ){
 	if ( !strlen( Texture[QUAKE3][1] ) ) {
 		strcpy( Texture[QUAKE3][1],   "textures/common/caulk" );
 	}
-	strcpy( gbmp.name, g_FuncTable.m_pfnProfileLoadString( file, "Bitmap","Filename","" ) );
+	Q_strncpyz( gbmp.name, g_FuncTable.m_pfnProfileLoadString( file, "Bitmap","Filename","" ), sizeof( gbmp.name ) );
 
 
 	gbmp.colors = NULL;
@@ -320,7 +320,7 @@ void ReadIniFile( const char *file ){
 		OpenBitmap();
 	}
 
-	strcpy( gbmp.defpath, g_FuncTable.m_pfnProfileLoadString( file, "Bitmap","DefaultPath","" ) );
+	Q_strncpyz( gbmp.defpath, g_FuncTable.m_pfnProfileLoadString( file, "Bitmap","DefaultPath","" ), sizeof( gbmp.defpath ) );
 
 	Text = g_FuncTable.m_pfnProfileLoadString( file, "Bitmap","BlackValue","" );
 	if ( strlen( Text ) ) {
@@ -353,7 +353,7 @@ char *va( const char *format, ... ){
 	static char string[1024];
 
 	va_start( argptr, format );
-	vsprintf( string, format,argptr );
+	vsnprintf( string, sizeof( string ), format, argptr );
 	va_end( argptr );
 
 	return string;
@@ -423,22 +423,22 @@ void SaveSetup( GtkWidget *parent ){
 													g_FuncTable.m_pfnProfileGetDirectory(), "gtkgensurf", NULL );
 
 	if ( name != NULL ) {
-		char key[32], text[32];
+		char key[32], text[128];
 		int i, j;
 
 		WriteIniFile( name );
 		g_FuncTable.m_pfnProfileSaveString( name, OPTS_SECTION,"MapFile",gszMapFile );
-		sprintf( text,"0x%04x",FileAppend );
+		snprintf( text, sizeof( text ), "0x%04x", FileAppend );
 		g_FuncTable.m_pfnProfileSaveString( name, OPTS_SECTION,"Append",text );
-		sprintf( text,"0x%04x",Decimate );
+		snprintf( text, sizeof( text ), "0x%04x", Decimate );
 		g_FuncTable.m_pfnProfileSaveString( name, OPTS_SECTION,"Decimate",text );
 		for ( i = 0; i <= NH; i++ )
 		{
 			for ( j = 0; j <= NV; j++ )
 			{
 				if ( xyz[i][j].fixed ) {
-					sprintf( key,"I%dJ%d",i,j );
+					snprintf( key, sizeof( key ), "I%dJ%d", i, j );
-					sprintf( text,"%g %g %g", xyz[i][j].fixed_value, xyz[i][j].range, xyz[i][j].rate );
+					snprintf( text, sizeof( text ), "%g %g %g", xyz[i][j].fixed_value, xyz[i][j].range, xyz[i][j].rate );
 					g_FuncTable.m_pfnProfileSaveString( name, "FixedPoints",key,text );
 				}
 			}
@@ -469,7 +469,7 @@ void OpenSetup( GtkWidget *parent, int UseDefaults ){
 		{
 			for ( j = 0; j <= NV; j++ )
 			{
-				sprintf( key,"I%dJ%d",i,j );
+				snprintf( key, sizeof( key ), "I%dJ%d", i, j );
 				text = g_FuncTable.m_pfnProfileLoadString( name, "FixedPoints", key, "" );
 				if ( strlen( text ) ) {
 					xyz[i][j].fixed = 1;

contrib/gtkgensurf/triangle.c

@@ -313,6 +313,11 @@
 #include "triangle.h"
 #endif /* TRILIBRARY */
 
+#ifndef Q_strncpyz
+#define Q_strncpyz(_dst, _source, _len) do { strncpy((_dst), (_source), (_len) - 1); if ((_len) > 0) (_dst)[(_len) - 1] = 0; } while( 0 )
+#endif
+
+
 /* The following obscenity seems to be necessary to ensure that this program */
 /* will port to Dec Alphas running OSF/1, because their stdio.h file commits */
 /* the unpardonable sin of including stdlib.h.  Hence, malloc(), free(), and */
@@ -2857,8 +2862,7 @@ char **argv;
 		}
 #ifndef TRILIBRARY
 	} else {
-		strncpy( innodefilename, argv[i], FILENAMESIZE - 1 );
+		Q_strncpyz( innodefilename, argv[i], FILENAMESIZE );
-		innodefilename[FILENAMESIZE - 1] = '\0';
 	}
 #endif /* not TRILIBRARY */
 	}
@@ -2907,11 +2911,11 @@ char **argv;
 	}
 
 #ifndef TRILIBRARY
-	strcpy( inpolyfilename, innodefilename );
+	Q_strncpyz( inpolyfilename, innodefilename, sizeof( inpolyfilename ) );
-	strcpy( inelefilename, innodefilename );
+	Q_strncpyz( inelefilename, innodefilename, sizeof( inelefilename ) );
-	strcpy( areafilename, innodefilename );
+	Q_strncpyz( areafilename, innodefilename, sizeof( areafilename ) );
 	increment = 0;
-	strcpy( workstring, innodefilename );
+	Q_strncpyz( workstring, innodefilename, sizeof( workstring ) );
 	j = 1;
 	while ( workstring[j] != '\0' ) {
 		if ( ( workstring[j] == '.' ) && ( workstring[j + 1] != '\0' ) ) {
@@ -2933,64 +2937,64 @@ char **argv;
 		} while ( workstring[j] != '\0' );
 	}
 	if ( noiterationnum ) {
-		strcpy( outnodefilename, innodefilename );
+		Q_strncpyz( outnodefilename, innodefilename, sizeof( outnodefilename ) );
-		strcpy( outelefilename, innodefilename );
+		Q_strncpyz( outelefilename, innodefilename, sizeof( outelefilename ) );
-		strcpy( edgefilename, innodefilename );
+		Q_strncpyz( edgefilename, innodefilename, sizeof( edgefilename ) );
-		strcpy( vnodefilename, innodefilename );
+		Q_strncpyz( vnodefilename, innodefilename, sizeof( vnodefilename ) );
-		strcpy( vedgefilename, innodefilename );
+		Q_strncpyz( vedgefilename, innodefilename, sizeof( vedgefilename ) );
-		strcpy( neighborfilename, innodefilename );
+		Q_strncpyz( neighborfilename, innodefilename, sizeof( neighborfilename ) );
-		strcpy( offfilename, innodefilename );
+		Q_strncpyz( offfilename, innodefilename, sizeof( offfilename ) );
-		strcat( outnodefilename, ".node" );
+		strncat( outnodefilename, ".node", sizeof( outnodefilename ) );
-		strcat( outelefilename, ".ele" );
+		strncat( outelefilename, ".ele", sizeof( outelefilename ) );
-		strcat( edgefilename, ".edge" );
+		strncat( edgefilename, ".edge", sizeof( edgefilename ) );
-		strcat( vnodefilename, ".v.node" );
+		strncat( vnodefilename, ".v.node", sizeof( vnodefilename ) );
-		strcat( vedgefilename, ".v.edge" );
+		strncat( vedgefilename, ".v.edge", sizeof( vedgefilename ) );
-		strcat( neighborfilename, ".neigh" );
+		strncat( neighborfilename, ".neigh", sizeof( neighborfilename ) );
-		strcat( offfilename, ".off" );
+		strncat( offfilename, ".off", sizeof( offfilename ) );
 	}
 	else if ( increment == 0 ) {
-		strcpy( outnodefilename, innodefilename );
+		Q_strncpyz( outnodefilename, innodefilename, sizeof( outnodefilename ) );
-		strcpy( outpolyfilename, innodefilename );
+		Q_strncpyz( outpolyfilename, innodefilename, sizeof( outpolyfilename ) );
-		strcpy( outelefilename, innodefilename );
+		Q_strncpyz( outelefilename, innodefilename, sizeof( outelefilename ) );
-		strcpy( edgefilename, innodefilename );
+		Q_strncpyz( edgefilename, innodefilename, sizeof( edgefilename ) );
-		strcpy( vnodefilename, innodefilename );
+		Q_strncpyz( vnodefilename, innodefilename, sizeof( vnodefilename ) );
-		strcpy( vedgefilename, innodefilename );
+		Q_strncpyz( vedgefilename, innodefilename, sizeof( vedgefilename ) );
-		strcpy( neighborfilename, innodefilename );
+		Q_strncpyz( neighborfilename, innodefilename, sizeof( neighborfilename ) );
-		strcpy( offfilename, innodefilename );
+		Q_strncpyz( offfilename, innodefilename, sizeof( offfilename ) );
-		strcat( outnodefilename, ".1.node" );
+		strncat( outnodefilename, ".1.node", sizeof( outnodefilename ) );
-		strcat( outpolyfilename, ".1.poly" );
+		strncat( outpolyfilename, ".1.poly", sizeof( outpolyfilename ) );
-		strcat( outelefilename, ".1.ele" );
+		strncat( outelefilename, ".1.ele", sizeof( outelefilename ) );
-		strcat( edgefilename, ".1.edge" );
+		strncat( edgefilename, ".1.edge", sizeof( edgefilename ) );
-		strcat( vnodefilename, ".1.v.node" );
+		strncat( vnodefilename, ".1.v.node", sizeof( vnodefilename ) );
-		strcat( vedgefilename, ".1.v.edge" );
+		strncat( vedgefilename, ".1.v.edge", sizeof( vedgefilename ) );
-		strcat( neighborfilename, ".1.neigh" );
+		strncat( neighborfilename, ".1.neigh", sizeof( neighborfilename ) );
-		strcat( offfilename, ".1.off" );
+		strncat( offfilename, ".1.off", sizeof( offfilename ) );
 	}
 	else {
 		workstring[increment] = '%';
 		workstring[increment + 1] = 'd';
 		workstring[increment + 2] = '\0';
-		sprintf( outnodefilename, workstring, meshnumber + 1 );
+		snprintf( outnodefilename, sizeof( outnodefilename ), workstring, meshnumber + 1 );
-		strcpy( outpolyfilename, outnodefilename );
+		Q_strncpyz( outpolyfilename, outnodefilename, sizeof( outpolyfilename ) );
-		strcpy( outelefilename, outnodefilename );
+		Q_strncpyz( outelefilename, outnodefilename, sizeof( outelefilename ) );
-		strcpy( edgefilename, outnodefilename );
+		Q_strncpyz( edgefilename, outnodefilename, sizeof( edgefilename ) );
-		strcpy( vnodefilename, outnodefilename );
+		Q_strncpyz( vnodefilename, outnodefilename, sizeof( vnodefilename ) );
-		strcpy( vedgefilename, outnodefilename );
+		Q_strncpyz( vedgefilename, outnodefilename, sizeof( vedgefilename ) );
-		strcpy( neighborfilename, outnodefilename );
+		Q_strncpyz( neighborfilename, outnodefilename, sizeof( neighborfilename ) );
-		strcpy( offfilename, outnodefilename );
+		Q_strncpyz( offfilename, outnodefilename, sizeof( offfilename ) );
-		strcat( outnodefilename, ".node" );
+		strncat( outnodefilename, ".node", sizeof( outnodefilename ) );
-		strcat( outpolyfilename, ".poly" );
+		strncat( outpolyfilename, ".poly", sizeof( outpolyfilename ) );
-		strcat( outelefilename, ".ele" );
+		strncat( outelefilename, ".ele", sizeof( outelefilename ) );
-		strcat( edgefilename, ".edge" );
+		strncat( edgefilename, ".edge", sizeof( edgefilename ) );
-		strcat( vnodefilename, ".v.node" );
+		strncat( vnodefilename, ".v.node", sizeof( vnodefilename ) );
-		strcat( vedgefilename, ".v.edge" );
+		strncat( vedgefilename, ".v.edge", sizeof( vedgefilename ) );
-		strcat( neighborfilename, ".neigh" );
+		strncat( neighborfilename, ".neigh", sizeof( neighborfilename ) );
-		strcat( offfilename, ".off" );
+		strncat( offfilename, ".off", sizeof( offfilename ) );
 	}
-	strcat( innodefilename, ".node" );
+	strncat( innodefilename, ".node", sizeof( innodefilename ) );
-	strcat( inpolyfilename, ".poly" );
+	strncat( inpolyfilename, ".poly", sizeof( inpolyfilename ) );
-	strcat( inelefilename, ".ele" );
+	strncat( inelefilename, ".ele", sizeof( inelefilename ) );
-	strcat( areafilename, ".area" );
+	strncat( areafilename, ".area", sizeof( areafilename ) );
 #endif /* not TRILIBRARY */
 }
 
@@ -10046,7 +10050,7 @@ char *polyfilename;
 			printf( "Inserting segments into Delaunay triangulation.\n" );
 		}
 #ifdef TRILIBRARY
-		strcpy( polyfilename, "input" );
+		Q_strncpyz( polyfilename, "input", sizeof( polyfilename ) );
 		segments = numberofsegments;
 		segmentmarkers = segmentmarkerlist != (int *) NULL;
 		index = 0;

contrib/gtkgensurf/view.cpp

@@ -320,14 +320,14 @@ static void motion( GtkWidget *widget, GdkEventMotion *event, gpointer data ){
 		{
 		case PLANE_XZ0:
 		case PLANE_XZ1:
-			sprintf( Text," x=%d, z=%d   ",(int)( floor( x - 0.5 ) + 1. ),(int)( floor( y - 0.5 ) + 1. ) );
+			snprintf( Text, sizeof( Text ), " x=%d, z=%d   ", (int)( floor( x - 0.5 ) + 1. ), (int)( floor( y - 0.5 ) + 1. ) );
 			break;
 		case PLANE_YZ0:
 		case PLANE_YZ1:
-			sprintf( Text," y=%d, z=%d   ",(int)( floor( x - 0.5 ) + 1. ),(int)( floor( y - 0.5 ) + 1. ) );
+			snprintf( Text, sizeof( Text ), " y=%d, z=%d   ", (int)( floor( x - 0.5 ) + 1. ), (int)( floor( y - 0.5 ) + 1. ) );
 			break;
 		default:
-			sprintf( Text," x=%d, y=%d   ",(int)( floor( x - 0.5 ) + 1. ),(int)( floor( y - 0.5 ) + 1. ) );
+			snprintf( Text, sizeof( Text ), " x=%d, y=%d   ", (int)( floor( x - 0.5 ) + 1. ), (int)( floor( y - 0.5 ) + 1. ) );
 		}
 
 		texfont_write( Text, rcCoord.left, rcCoord.top );

contrib/hydratoolz/plugin.cpp

@@ -146,7 +146,7 @@ GSList *AddToWadList( GSList *wadlist, const char *shadername, const char *wad )
 		}
 		else
 		{
-			Sys_Printf( "HydraToolz: WARNING: Unknown wad file for shader %s\n",shadername );
+			Sys_FPrintf( SYS_WRN, "HydraToolz: WARNING: Unknown wad file for shader %s\n",shadername );
 			return wadlist;
 		}
 
@@ -199,7 +199,7 @@ void UpdateWadKeyPair( void ){
 	for ( pEpair = pEntity->epairs; pEpair != NULL; pEpair = pEpair->next )
 	{
 		if ( stricmp( pEpair->key,"wad" ) == 0 ) {
-			strcpy( wads,pEpair->value );
+			Q_strncpyz( wads, pEpair->value, sizeof( wads ) );
 			HYDRA_ConvertDOSToUnixName( wads,wads );
 
 			Sys_Printf( "HydraToolz: Current wad key is \"%s\"!\n",wads );
@@ -295,18 +295,18 @@ void UpdateWadKeyPair( void ){
 		else
 		{
 			if ( wads[0] ) {
-				strcat( wads,";" );
+				strncat( wads, ";", sizeof( wads ) );
 			}
 
 			actualwad = vfsGetFullPath( (char *)wadlist->data, 0, 0 );
 
 			if ( actualwad ) {
-				strcat( wads, actualwad );
+				strncat( wads, actualwad, sizeof( wads ) );
 			}
 			else
 			{
 				Sys_FPrintf( SYS_WRN, "WARNING: could not locate wad file %s\n",(char *)wadlist->data );
-				strcat( wads, (char *)wadlist->data );
+				strncat( wads, (char *)wadlist->data, sizeof( wads ) );
 			}
 		}
 

contrib/prtview/ConfigDialog.cpp

@@ -99,17 +99,17 @@ static int DoColor( COLORREF *c ){
 }
 
 static void Set2DText( GtkWidget* label ){
-	char s[40];
+	char s[64];
 
-	sprintf( s, "Line Width = %6.3f", portals.width_2d * 0.5f );
+	snprintf( s, sizeof( s ), "Line Width = %6.3f", portals.width_2d * 0.5f );
 
 	gtk_label_set_text( GTK_LABEL( label ), s );
 }
 
 static void Set3DText( GtkWidget* label ){
-	char s[40];
+	char s[64];
 
-	sprintf( s, "Line Width = %6.3f", portals.width_3d * 0.5f );
+	snprintf( s, sizeof( s ), "Line Width = %6.3f", portals.width_3d * 0.5f );
 
 	gtk_label_set_text( GTK_LABEL( label ), s );
 }
@@ -117,7 +117,7 @@ static void Set3DText( GtkWidget* label ){
 static void Set3DTransText( GtkWidget* label ){
 	char s[40];
 
-	sprintf( s, "Polygon transparency = %d%%", (int)portals.trans_3d );
+	snprintf( s, sizeof( s ), "Polygon transparency = %d%%", (int)portals.trans_3d );
 
 	gtk_label_set_text( GTK_LABEL( label ), s );
 }
@@ -125,7 +125,7 @@ static void Set3DTransText( GtkWidget* label ){
 static void SetClipText( GtkWidget* label ){
 	char s[40];
 
-	sprintf( s, "Cubic clip range = %d", (int)portals.clip_range * 64 );
+	snprintf( s, sizeof( s ), "Cubic clip range = %d", (int)portals.clip_range * 64 );
 
 	gtk_label_set_text( GTK_LABEL( label ), s );
 }

contrib/prtview/LoadPortalFileDialog.cpp

@@ -159,11 +159,11 @@ int DoLoadPortalFileDialog(){
 	gtk_widget_set_usize( button, 60, -2 );
 
 	char *fn = g_FuncTable.m_pfnGetMapName();
-	strcpy( portals.fn, fn );
+	Q_strncpyz( portals.fn, fn, sizeof( portals.fn ) );
 	fn = strrchr( portals.fn, '.' );
 	if ( fn != NULL ) {
 		*fn = '\0';
-		strcat( portals.fn, ".prt" );
+		strncat( portals.fn, ".prt", sizeof( portals.fn ) );
 	}
 
 	gtk_entry_set_text( GTK_ENTRY( entry ), portals.fn );

contrib/prtview/prtview.cpp

@@ -55,6 +55,8 @@ static char INIfn[NAME_MAX];
 #define CLIP_RANGE "ClipRange"
 #define CLIP "Clip"
 
+void *g_pMainWidget = NULL;
+
 void InitInstance(){
 #ifdef _WIN32
 	char fn[_MAX_PATH];
@@ -67,15 +69,15 @@ void InitInstance(){
 
 	_splitpath( fn, fn_drive, fn_dir, fn_name, fn_ext );
 
-	strcpy( INIfn, fn_drive );
+	Q_strncpyz( INIfn, fn_drive, sizeof( INIfn ) );
-	strcat( INIfn, fn_dir );
+	strncat( INIfn, fn_dir, sizeof( INIfn ) );
-	strcat( INIfn, fn_name );
+	strncat( INIfn, fn_name, sizeof( INIfn ) );
-	strcat( INIfn, ".ini" );
+	strncat( INIfn, ".ini", sizeof( INIfn ) );
 #else // if def __linux__
-	strcpy( INIfn, g_get_home_dir() );
+	Q_strncpyz( INIfn, g_get_home_dir(), sizeof( INIfn ) );
-	strcat( INIfn, "/.radiant/" );
+	strncat( INIfn, "/.radiant/", sizeof( INIfn ) );
-	strcat( INIfn, RADIANT_VERSION );
+	strncat( INIfn, RADIANT_VERSION, sizeof( INIfn ) );
-	strcat( INIfn, "/prtview.ini" );
+	strncat( INIfn, "/prtview.ini", sizeof( INIfn ) );
 #endif
 
 	portals.show_2d = INIGetInt( RENDER_2D, FALSE ) ? true : false;
@@ -166,7 +168,7 @@ _QERQglTable g_QglTable;
 
 #if defined( __linux__ ) || defined( __APPLE__ )
 
-static bool read_var( const char *filename, const char *section, const char *key, char *value ){
+static bool read_var( const char *filename, const char *section, const char *key, char *value, size_t length ){
 	char line[1024], *ptr;
 	FILE *rc;
 
@@ -199,7 +201,7 @@ static bool read_var( const char *filename, const char *section, const char *key
 				*ptr = '\0';
 
 				if ( strcmp( line, key ) == 0 ) {
-					strcpy( value, ptr + 1 );
+					Q_strncpyz( value, ptr + 1, length );
 					fclose( rc );
 
 					while ( value[strlen( value ) - 1] == 10 ||
@@ -317,7 +319,7 @@ int INIGetInt( const char *key, int def ){
 #if defined( __linux__ ) || defined( __APPLE__ )
 	char value[1024];
 
-	if ( read_var( INIfn, CONFIG_SECTION, key, value ) ) {
+	if ( read_var( INIfn, CONFIG_SECTION, key, value, sizeof( value ) ) ) {
 		return atoi( value );
 	}
 	else{
@@ -332,10 +334,10 @@ void INISetInt( const char *key, int val, const char *comment /* = NULL */ ){
 	char s[1000];
 
 	if ( comment ) {
-		sprintf( s, "%d        ; %s", val, comment );
+		snprintf( s, sizeof( s ), "%d        ; %s", val, comment );
 	}
 	else{
-		sprintf( s, "%d", val );
+		snprintf( s, sizeof( s ), "%d", val );
 	}
 #if defined( __linux__ ) || defined( __APPLE__ )
 	save_var( INIfn, CONFIG_SECTION, key, s );
@@ -387,7 +389,7 @@ extern "C" const char* QERPlug_GetCommandList(){
    char buf[32768];
 
    va_start (argptr,text);
-   vsprintf (buf, text, argptr);
+   vsnprintf (buf, sizeof( buf ), text, argptr);
    va_end (argptr);
 
    g_FuncTable.m_pfnSysMsg (buf);

include/qerplugin.h

@@ -33,6 +33,12 @@
 
 #include <stdio.h>
 #include <string.h>
+#if defined(_MSC_VER) && _MSC_VER<1900 && !(defined snprintf)
+#define snprintf _snprintf
+#endif
+#ifndef Q_strncpyz
+#define Q_strncpyz(_dst, _source, _len) do { strncpy((_dst), (_source), (_len) - 1); (_dst)[(_len) - 1] = 0; } while( 0 )
+#endif
 // TTimo
 // ideally the plugin API would be UI toolkit independent, but removing the dependency with GLib seems tricky right now..
 #include <glib.h>

libs/cmdlib.h

@@ -49,14 +49,26 @@
   #define Q_mkdir( a,b ) mkdir( a,b )
 #endif
 
-void    DefaultExtension( char *path, char *extension );
+#if defined(_MSC_VER) && _MSC_VER<1900 && !(defined safe_malloc)
-void    DefaultPath( char *path, char *basepath );
+void *safe_malloc( size_t size );
+void *safe_malloc_info( size_t size, char* info );
+#endif
+
+#if defined(_MSC_VER) && _MSC_VER<1900 && !(defined snprintf)
+#define snprintf _snprintf
+#endif
+#ifndef Q_strncpyz
+#define Q_strncpyz(_dst, _source, _len) do { strncpy((_dst), (_source), (_len) - 1); if ((_len) > 0) (_dst)[(_len) - 1] = 0; } while( 0 )
+#endif
+
+void    DefaultExtension( char *path, char *extension, size_t length );
+void    DefaultPath( char *path, const char *basepath, size_t length );
 void    StripFilename( char *path );
 void    StripExtension( char *path );
-void    ExtractFilePath( const char *path, char *dest );
+void    ExtractFilePath( const char *path, char *dest, size_t size );
-void    ExtractFileName( const char *path, char *dest );
+void    ExtractFileName( const char *path, char *dest, size_t size );
-void    ExtractFileBase( const char *path, char *dest );
+void    ExtractFileBase( const char *path, char *dest, size_t size );
-void    ExtractFileExtension( const char *path, char *dest );
+void    ExtractFileExtension( const char *path, char *dest, size_t size );
 /*!
    \brief create all directories leading to a file path. if you pass a directory, terminate it with a '/'
  */

libs/cmdlib/cmdlib.cpp

@@ -51,14 +51,14 @@ bool Q_Exec( const char *cmd, char *cmdline, const char *execdir, bool bCreateCo
 	case 0:
 		// always concat the command on linux
 		if ( cmd ) {
-			strcpy( fullcmd, cmd );
+			Q_strncpyz( fullcmd, cmd, sizeof( fullcmd ) );
 		}
 		else{
 			fullcmd[0] = '\0';
 		}
 		if ( cmdline ) {
-			strcat( fullcmd, " " );
+			strncat( fullcmd, " ", sizeof( fullcmd ) );
-			strcat( fullcmd, cmdline );
+			strncat( fullcmd, cmdline, sizeof( fullcmd ) );
 		}
 		pCmd = fullcmd;
 		while ( *pCmd == ' ' )
@@ -159,7 +159,7 @@ int Q_filelength( FILE *f ){
 	return end;
 }
 
-void DefaultExtension( char *path, char *extension ){
+void DefaultExtension( char *path, char *extension, size_t length ){
 	char    *src;
 //
 // if path doesn't have a .EXT, append extension
@@ -175,18 +175,18 @@ void DefaultExtension( char *path, char *extension ){
 		src--;
 	}
 
-	strcat( path, extension );
+	strncat( path, extension, length );
 }
 
-void DefaultPath( char *path, char *basepath ){
+void DefaultPath( char *path, const char *basepath, size_t length ){
-	char temp[128];
+	char temp[PATH_MAX];
 
 	if ( path[0] == PATHSEPERATOR ) {
 		return;               // absolute path location
 	}
-	strcpy( temp,path );
+	Q_strncpyz( temp, path, sizeof( temp ) );
-	strcpy( path,basepath );
+	Q_strncpyz( path, basepath, length );
-	strcat( path,temp );
+	strncat( path, temp, length );
 }
 
 
@@ -221,8 +221,9 @@ void    StripExtension( char *path ){
    Extract file parts
    ====================
  */
-void ExtractFilePath( const char *path, char *dest ){
+void ExtractFilePath( const char *path, char *dest, size_t size ){
 	const char *src;
+	size_t length;
 
 	src = path + strlen( path ) - 1;
 
@@ -232,13 +233,20 @@ void ExtractFilePath( const char *path, char *dest ){
 	while ( src != path && *( src - 1 ) != '/' && *( src - 1 ) != '\\' )
 		src--;
 
-	memcpy( dest, path, src - path );
+	length = src - path;
-	dest[src - path] = 0;
+	if( length + 1 > size )
+	{
+		length = size - 1;
+	}
+	memcpy( dest, path, length );
+	dest[length] = 0;
 }
 
-void ExtractFileName( const char *path, char *dest ){
+void ExtractFileName( const char *path, char *dest, size_t size ){
 	const char *src;
 
+	if( size <= 0 )
+		return;
 	src = path + strlen( path ) - 1;
 
 //
@@ -250,7 +258,13 @@ void ExtractFileName( const char *path, char *dest ){
 
 	while ( *src )
 	{
+		if( size == 1 )
+		{
+			*dest = 0;
+			return;
+		}
 		*dest++ = *src++;
+		size--;
 	}
 	*dest = 0;
 }
@@ -278,14 +292,18 @@ inline unsigned int filename_get_base_length( const char* filename ){
 	return ( last_period != NULL ) ? last_period - filename : strlen( filename );
 }
 
-void ExtractFileBase( const char *path, char *dest ){
+void ExtractFileBase( const char *path, char *dest, size_t size ){
 	const char* filename = path_get_filename_start( path );
 	unsigned int length = filename_get_base_length( filename );
+	if( length > size )
+	{
+		length = size - 1;
+	}
 	strncpy( dest, filename, length );
 	dest[length] = '\0';
 }
 
-void ExtractFileExtension( const char *path, char *dest ){
+void ExtractFileExtension( const char *path, char *dest, size_t size ){
 	const char *src;
 
 	src = path + strlen( path ) - 1;
@@ -300,7 +318,7 @@ void ExtractFileExtension( const char *path, char *dest ){
 		return;
 	}
 
-	strcpy( dest,src );
+	Q_strncpyz( dest, src, size );
 }
 
 
@@ -338,7 +356,7 @@ void CreateDirectoryPath( const char *path ) {
 	char *src;
 	char back;
 
-	ExtractFilePath( path, base );
+	ExtractFilePath( path, base, sizeof( base ) );
 
 	src = base + 1;
 	while ( 1 ) {

libs/l_net/l_net.c

@@ -48,7 +48,7 @@ void WinPrint( char *str, ... ){
 	char text[4096];
 
 	va_start( argptr,str );
-	vsprintf( text, str, argptr );
+	vsnprintf( text, sizeof( text ), str, argptr );
 	va_end( argptr );
 
 	printf("%s", text );

libs/picomodel/picointernal.c

@@ -263,7 +263,7 @@ void _pico_printf( int level, const char *format, ... ){
 
 	/* format string */
 	va_start( argptr,format );
-	vsprintf( str,format,argptr );
+	vsnprintf( str, sizeof( str ), format, argptr );
 	va_end( argptr );
 
 	/* remove linefeeds */
@@ -629,7 +629,7 @@ char *_pico_nopath( const char *path ){
  *  or filepath's filename portion. the given 'path' *is*
  *  altered. leave 'ext' empty to remove extension. -sea
  */
-char *_pico_setfext( char *path, const char *ext ){
+char *_pico_setfext( char *path, const char *ext, size_t length ){
 	char *src;
 	int remfext = 0;
 
@@ -660,7 +660,7 @@ char *_pico_setfext( char *path, const char *ext ){
 			break;
 		}
 	}
-	strcat( path,ext );
+	strncat( path, ext, length );
 	return path;
 }
 

libs/picomodel/picointernal.h

@@ -54,6 +54,12 @@ extern "C"
 
 #include "picomodel.h"
 
+#if defined(_MSC_VER) && _MSC_VER<1900 && !(defined snprintf)
+#define snprintf _snprintf
+#endif
+#ifndef Q_strncpyz
+#define Q_strncpyz(_dst, _source, _len) do { strncpy((_dst), (_source), (_len) - 1); if ((_len) > 0) (_dst)[(_len) - 1] = 0; } while( 0 )
+#endif
 
 /* os dependant replacements */
 #if WIN32 || _WIN32
@@ -132,7 +138,7 @@ char            *_pico_stristr( char *str, const char *substr );
 void            _pico_unixify( char *path );
 int             _pico_nofname( const char *path, char *dest, int destSize );
 char            *_pico_nopath( const char *path );
-char            *_pico_setfext( char *path, const char *ext );
+char            *_pico_setfext( char *path, const char *ext, size_t length );
 int             _pico_getline( char *buf, int bufsize, char *dest, int destsize );
 char            *_pico_strlwr( char *str );
 

libs/picomodel/picomodel.c

@@ -212,11 +212,12 @@ picoModel_t *PicoLoadModel( char *fileName, int frameNum ){
 			/* apply model remappings from <model>.remap */
 			if ( strlen( modelFileName ) ) {
 				/* alloc copy of model file name */
-				remapFileName = _pico_alloc( strlen( modelFileName ) + 20 );
+				size_t length = strlen( modelFileName ) + 20;
+				remapFileName = _pico_alloc( length );
 				if ( remapFileName != NULL ) {
 					/* copy model file name and change extension */
-					strcpy( remapFileName, modelFileName );
+					Q_strncpyz( remapFileName, modelFileName, length );
-					_pico_setfext( remapFileName, "remap" );
+					_pico_setfext( remapFileName, "remap", length );
 
 					/* try to remap model; we don't handle the result */
 					PicoRemapModel( model, remapFileName );
@@ -509,7 +510,7 @@ picoSurface_t *PicoNewSurface( picoModel_t *model ){
 		surface->model = model;
 
 		/* set default name */
-		sprintf( surfaceName, "Unnamed_%d", model->numSurfaces );
+		snprintf( surfaceName, sizeof( surfaceName ), "Unnamed_%d", model->numSurfaces );
 		PicoSetSurfaceName( surface, surfaceName );
 	}
 

libs/picomodel/pm_3ds.c

@@ -421,23 +421,23 @@ static int GetMeshShader( T3dsLoaderPers *pers ){
 			char *name;
 
 			/* copy map name to local buffer */
-			strcpy( mapName,mapNamePtr );
+			Q_strncpyz( mapName, mapNamePtr, sizeof( mapName ) );
 
 			/* extract file name */
 			name = _pico_nopath( mapName );
-			strncpy( temp, name, sizeof( temp ) );
+			Q_strncpyz( temp, name, sizeof( temp ) );
 
 			/* remove file extension */
 			/* name = _pico_setfext( name,"" ); */
 
 			/* assign default name if no name available */
 			if ( strlen( temp ) < 1 ) {
-				strcpy( temp,pers->basename );
+				Q_strncpyz( temp, pers->basename, sizeof( temp ) );
 			}
 
 			/* build shader name */
 			_pico_strlwr( temp ); /* gaynux update -sea */
-			sprintf( mapName,"models/mapobjects/%s/%s",pers->basename,temp );
+			snprintf( mapName, sizeof( mapName ), "models/mapobjects/%s/%s", pers->basename, temp );
 
 			/* set shader name */
 			/* PicoSetShaderName( shader,mapName ); */	/* ydnar: this will screw up the named shader */
@@ -730,9 +730,8 @@ static picoModel_t *_3ds_load( PM_PARAMS_LOAD ){
 		return NULL;
 	}
 	/* get model's base name (eg. jeep from c:\models\jeep.3ds) */
-	memset( basename,0,sizeof( basename ) );
+	Q_strncpyz( basename, _pico_nopath( fileName ), sizeof( basename ) );
-	strncpy( basename,_pico_nopath( fileName ),sizeof( basename ) );
+	_pico_setfext( basename, "", sizeof( basename ) );
-	_pico_setfext( basename,"" );
 
 	/* initialize persistant vars (formerly static) */
 	pers.model    =  model;

libs/picomodel/pm_ase.c

@@ -408,7 +408,7 @@ static picoModel_t *_ase_load( PM_PARAMS_LOAD ){
 			}
 
 			/* remember node name */
-			strncpy( lastNodeName,ptr,sizeof( lastNodeName ) );
+			Q_strncpyz( lastNodeName, ptr, sizeof( lastNodeName ) );
 		}
 		/* model mesh (originally contained within geomobject) */
 		else if ( !_pico_stricmp( p->token, "*mesh" ) ) {
@@ -801,7 +801,8 @@ static picoModel_t *_ase_load( PM_PARAMS_LOAD ){
 						_ase_error_return( "Missing material name" );
 					}
 
-					strcpy( materialName, name );
+					Q_strncpyz( materialName, name, sizeof( materialName ) );
+					materialName[sizeof( materialName ) - 1] = 0;
 					/* skip rest and continue with next token */
 					_pico_parse_skip_rest( p );
 					continue;

libs/picomodel/pm_fm.c

@@ -350,7 +350,7 @@ static picoModel_t *_fm_load( PM_PARAMS_LOAD ){
 		texCoord->t = _pico_little_short( texCoord[i].t );
 	}
 	// set Skin Name
-	strncpy( skinname, (char *) fm.fm_skin, FM_SKINPATHSIZE );
+	Q_strncpyz( skinname, (char *) fm.fm_skin, FM_SKINPATHSIZE );
 
 #ifdef FM_VERBOSE_DBG
 	// Print out md2 values
@@ -358,7 +358,7 @@ static picoModel_t *_fm_load( PM_PARAMS_LOAD ){
 #endif
 
 	// detox Skin name
-	_pico_setfext( skinname, "" );
+	_pico_setfext( skinname, "", sizeof( skinname ) );
 	_pico_unixify( skinname );
 
 	/* create new pico model */

libs/picomodel/pm_lwo.c

@@ -234,8 +234,8 @@ static picoModel_t *_lwo_load( PM_PARAMS_LOAD ){
 		}
 
 		/* detox and set shader name */
-		strncpy( name, surface->name, sizeof( name ) );
+		Q_strncpyz( name, surface->name, sizeof( name ) );
-		_pico_setfext( name, "" );
+		_pico_setfext( name, "", sizeof( name ) );
 		_pico_unixify( name );
 		PicoSetShaderName( picoShader, name );
 

libs/picomodel/pm_md2.c

@@ -431,7 +431,7 @@ static picoModel_t *_md2_load( PM_PARAMS_LOAD ){
 	}
 
 	// set Skin Name
-	strncpy( skinname, (char *) ( bb + md2->ofsSkins ), MD2_MAX_SKINNAME );
+	Q_strncpyz( skinname, (char *) ( bb + md2->ofsSkins ), MD2_MAX_SKINNAME );
 
 	// Print out md2 values
 	_pico_printf( PICO_VERBOSE,"Skins: %d  Verts: %d  STs: %d  Triangles: %d  Frames: %d\nSkin Name \"%s\"\n", md2->numSkins, md2->numXYZ, md2->numST, md2->numTris, md2->numFrames, skinname );
@@ -439,7 +439,8 @@ static picoModel_t *_md2_load( PM_PARAMS_LOAD ){
 	// relative texture path - allows moving of models in game dir structure without changing the skinpath
 	// e.g. used in ufo:ai
 	if ( skinname[0] == '.' ) {
-		strncpy( path, fileName, MD2_MAX_SKINNAME );
+		Q_strncpyz( path, fileName, MD2_MAX_SKINNAME );
+
 		for ( i = MD2_MAX_SKINNAME; i--; ) {
 			// skip filename
 			if ( path[i] == '/' || path[i] == '\\' ) {
@@ -448,14 +449,14 @@ static picoModel_t *_md2_load( PM_PARAMS_LOAD ){
 			path[i] = '\0';
 		}
 		strncat( path, &skinname[1], MD2_MAX_SKINNAME );
-		strncpy( skinname, path, MD2_MAX_SKINNAME );
+		Q_strncpyz( skinname, path, MD2_MAX_SKINNAME );
 
 		// Print out md2 values
 		_pico_printf( PICO_VERBOSE,"Relative skin path converted to: \"%s\" (%s)\n", skinname, fileName );
 	}
 
 	// detox Skin name
-	_pico_setfext( skinname, "" );
+	_pico_setfext( skinname, "", sizeof( skinname ) );
 	_pico_unixify( skinname );
 
 	/* create new pico model */

libs/picomodel/pm_md3.c

@@ -344,7 +344,7 @@ static picoModel_t *_md3_load( PM_PARAMS_LOAD ){
 
 		/* detox and set shader name */
 		shader = (md3Shader_t*) ( (picoByte_t*) surface + surface->ofsShaders );
-		_pico_setfext( shader->name, "" );
+		_pico_setfext( shader->name, "", sizeof( shader->name ) );
 		_pico_unixify( shader->name );
 		PicoSetShaderName( picoShader, shader->name );
 

libs/picomodel/pm_mdc.c

@@ -644,7 +644,7 @@ static picoModel_t *_mdc_load( PM_PARAMS_LOAD ){
 
 		/* detox and set shader name */
 		shader = (mdcShader_t*) ( (picoByte_t*) surface + surface->ofsShaders );
-		_pico_setfext( shader->name, "" );
+		_pico_setfext( shader->name, "", sizeof( shader->name ) );
 		_pico_unixify( shader->name );
 		PicoSetShaderName( picoShader, shader->name );
 

libs/splines/math_vector.cpp

@@ -136,7 +136,7 @@ idVec3 LerpVector( idVec3 &w1, idVec3 &w2, const float t ) {
  */
 char *idVec3::string( void ) {
 	static int index = 0;
-	static char str[ 8 ][ 36 ];
+	static char str[ 8 ][ 256 ];
 	char    *s;
 
 	// use an array so that multiple toString's won't collide

libs/splines/q_parse.cpp

@@ -100,7 +100,7 @@ void Com_ScriptError( const char *msg, ... ) {
 	char string[32000];
 
 	va_start( argptr, msg );
-	vsprintf( string, msg,argptr );
+	vsnprintf( string, sizeof( string ), msg, argptr );
 	va_end( argptr );
 
 	Com_Error( ERR_DROP, "File %s, line %i: %s", pi->parseFile, pi->lines, string );
@@ -111,7 +111,7 @@ void Com_ScriptWarning( const char *msg, ... ) {
 	char string[32000];
 
 	va_start( argptr, msg );
-	vsprintf( string, msg,argptr );
+	vsnprintf( string, sizeof( string ), msg, argptr );
 	va_end( argptr );
 
 	Com_Printf( "File %s, line %i: %s", pi->parseFile, pi->lines, string );

libs/splines/q_shared.cpp

@@ -472,7 +472,7 @@ int Com_ParseInfos( const char *buf, int max, char infos[][MAX_INFO_STRING] ) {
 			if ( !token[0] ) {
 				token = "<NULL>";
 			}
-			Info_SetValueForKey( infos[count], key, token );
+			Info_SetValueForKey( infos[count], key, token, sizeof( infos[count] ) );
 		}
 		count++;
 	}
@@ -695,7 +695,7 @@ void QDECL Com_sprintf( char *dest, int size, const char *fmt, ... ) {
 	char bigbuffer[32000];      // big, but small enough to fit in PPC stack
 
 	va_start( argptr,fmt );
-	len = vsprintf( bigbuffer,fmt,argptr );
+	len = vsnprintf( bigbuffer, sizeof( bigbuffer ), fmt, argptr );
 	va_end( argptr );
 	if ( len < 0 ) {
 		Com_Error( ERR_FATAL, "Com_sprintf: failed to write bigbuffer" );
@@ -729,7 +729,7 @@ char    * QDECL va( const char *format, ... ) {
 	index++;
 
 	va_start( argptr, format );
-	vsprintf( buf, format,argptr );
+	vsnprintf( buf, sizeof( string[index & 1] ), format, argptr );
 	va_end( argptr );
 
 	return buf;
@@ -932,7 +932,7 @@ qboolean Info_Validate( const char *s ) {
    Changes or adds a key/value pair
    ==================
  */
-void Info_SetValueForKey( char *s, const char *key, const char *value ) {
+void Info_SetValueForKey( char *s, const char *key, const char *value, size_t length ) {
 	char newi[MAX_INFO_STRING];
 
 	if ( strlen( s ) >= MAX_INFO_STRING ) {
@@ -966,7 +966,7 @@ void Info_SetValueForKey( char *s, const char *key, const char *value ) {
 		return;
 	}
 
-	strcat( s, newi );
+	Q_strcat( s, length, newi );
 }
 
 //====================================================================

libs/splines/q_shared.h

@@ -771,7 +771,7 @@ int         Com_IndexForGrowListElement( const growList_t *list, const void *ele
 //
 char *Info_ValueForKey( const char *s, const char *key );
 void Info_RemoveKey( char *s, const char *key );
-void Info_SetValueForKey( char *s, const char *key, const char *value );
+void Info_SetValueForKey( char *s, const char *key, const char *value, size_t length );
 qboolean Info_Validate( const char *s );
 void Info_NextPair( const char *( *s ), char key[MAX_INFO_KEY], char value[MAX_INFO_VALUE] );
 

libs/splines/splines.cpp

@@ -553,8 +553,7 @@ bool idCameraDef::getCameraInfo( long time, idVec3 &origin, idVec3 &direction, f
 				//}
 			}
 			else if ( events[i]->getType() == idCameraEvent::EVENT_FOV ) {
-				memset( buff, 0, sizeof( buff ) );
+				Q_strncpyz( buff, events[i]->getParam(), sizeof( buff ) );
-				strcpy( buff, events[i]->getParam() );
 				const char *param1 = strtok( buff, " \t,\0" );
 				const char *param2 = strtok( NULL, " \t,\0" );
 				float len = ( param2 ) ? atof( param2 ) : 0;
@@ -574,7 +573,7 @@ bool idCameraDef::getCameraInfo( long time, idVec3 &origin, idVec3 &direction, f
 			}
 			else if ( events[i]->getType() == idCameraEvent::EVENT_CAMERA ) {
 				memset( buff, 0, sizeof( buff ) );
-				strcpy( buff, events[i]->getParam() );
+				Q_strncpyz( buff, events[i]->getParam(), sizeof( buff ) );
 				const char *param1 = strtok( buff, " \t,\0" );
 				const char *param2 = strtok( NULL, " \t,\0" );
 

libs/splines/util_str.cpp

@@ -260,7 +260,7 @@ idStr operator+
 	const idStr& a,
 	const float b
 ){
-	char text[ 20 ];
+	char text[ 64 ];
 
 	idStr result( a );
 
@@ -304,7 +304,7 @@ idStr& idStr::operator+=
 (
 	const float a
 ){
-	char text[ 20 ];
+	char text[ 64 ];
 
 	sprintf( text, "%f", a );
 	append( text );
@@ -371,6 +371,7 @@ void idStr::EnsureDataWritable
 
 	EnsureAlloced( len + 1, false );
 	strncpy( m_data->data, olddata->data, len + 1 );
+	m_data->data[len] = 0;
 	m_data->len = len;
 
 	olddata->DelRef();
@@ -447,12 +448,13 @@ void idStr::snprintf
 	va_list argptr;
 
 	va_start( argptr,fmt );
-	len = vsprintf( buffer,fmt,argptr );
+	len = vsnprintf( buffer, sizeof( buffer ), fmt, argptr );
 	va_end( argptr );
 
 	assert( len < size );
 
 	strncpy( dst, buffer, size - 1 );
+	dst[size - 1] = NULL;
 }
 
 #ifdef _WIN32

libs/str.h

@@ -52,6 +52,15 @@
 #define strcasecmp strcmpi
 #endif
 
+#if defined(_MSC_VER) && _MSC_VER<1900 && !(defined snprintf)
+#define snprintf _snprintf
+#endif
+
+#ifndef Q_strncpyz
+#define Q_strncpyz(_dst, _source, _len) do { strncpy((_dst), (_source), (_len) - 1); if ((_len) > 0) (_dst)[(_len) - 1] = 0; } while( 0 )
+#endif
+
+
 // NOTE TTimo __StrDup was initially implemented in pakstuff.cpp
 //   causing a bunch of issues for broader targets that use Str.h (such as plugins and modules)
 //   Q_StrDup should be used now, using a #define __StrDup for easy transition

plugins/eclassfgd/plugin.cpp

@@ -366,7 +366,7 @@ class_t *Find_Class( GSList *l,char *classname, class_t *ignore ){
    Note: this is somewhat recursive, as a class can require a class that requires a class and so on..
  */
 void EClass_ImportFromClass( eclass_t *e, GSList *l_classes, class_t *bc ){
-	char color[128];
+	char color[256];
 
 	// We allocate 16k here, but only the memory actually used is kept allocated.
 	// this is just used for building the final comments string.
@@ -382,7 +382,7 @@ void EClass_ImportFromClass( eclass_t *e, GSList *l_classes, class_t *bc ){
 	//represent the final values.
 
 	if ( bc->description ) {
-		sprintf( newcomments,"%s\n",bc->description );
+		snprintf( newcomments, sizeof( newcomments ), "%s\n", bc->description );
 		e->comments = addstr( e->comments, newcomments );
 		newcomments[0] = 0; // so we don't add them twice.
 	}
@@ -450,7 +450,7 @@ void EClass_ImportFromClass( eclass_t *e, GSList *l_classes, class_t *bc ){
 	// COLOR
 	if ( bc->gotcolor ) {
 		memcpy( e->color, bc->color, sizeof( vec3_t ) );
-		sprintf( color, "(%f %f %f)", e->color[0], e->color[1], e->color[2] );
+		snprintf( color, sizeof( color ), "(%f %f %f)", e->color[0], e->color[1], e->color[2] );
 		e->texdef.SetName( color );
 	}
 
@@ -463,7 +463,9 @@ void EClass_ImportFromClass( eclass_t *e, GSList *l_classes, class_t *bc ){
 			if ( opt->optiontype != OPTION_FLAGS ) {
 				// add some info to the comments.
 				if ( opt->optioninfo ) {
-					sprintf( newcomments + strlen( newcomments ),"%s '%s' %s%s\n",
+					snprintf( newcomments + strlen( newcomments ), 
+						sizeof( newcomments ) - strlen( newcomments ),
+						"%s '%s' %s%s\n",
 						opt->epairname,
 						opt->optioninfo ? opt->optioninfo : "",
 						opt->optiondefault ? ", Default: " : "",
@@ -471,7 +473,9 @@ void EClass_ImportFromClass( eclass_t *e, GSList *l_classes, class_t *bc ){
 				}
 				else
 				{
-					sprintf( newcomments + strlen( newcomments ),"%s %s%s\n",
+					snprintf( newcomments + strlen( newcomments ),
+						sizeof( newcomments ) - strlen( newcomments ),
+						"%s %s%s\n",
 						opt->epairname,
 						opt->optiondefault ? ", Default: " : "",
 						opt->optiondefault ? opt->optiondefault : "" );
@@ -490,7 +494,7 @@ void EClass_ImportFromClass( eclass_t *e, GSList *l_classes, class_t *bc ){
 					int index = getindex( choice->value );
 					index--;
 					if ( index < MAX_FLAGS ) {
-						strcpy( e->flagnames[index],choice->name );
+						Q_strncpyz( e->flagnames[index], choice->name, sizeof( e->flagnames[index] ) );
 					}
 					else
 					{
@@ -499,11 +503,14 @@ void EClass_ImportFromClass( eclass_t *e, GSList *l_classes, class_t *bc ){
 				}
 				break;
 			case OPTION_CHOICES:
-				strcat( newcomments,"  Choices:\n" );
+				strncat( newcomments, "  Choices:\n", sizeof( newcomments ) );
 				for ( choicelst = opt->choices; choicelst != NULL; choicelst = choicelst->next )
 				{
 					choice_t *choice = (choice_t*) choicelst->data;
-					sprintf( newcomments + strlen( newcomments ),"  %5d - %s\n",choice->value,choice->name );
+					snprintf( newcomments + strlen( newcomments ), 
+						sizeof( newcomments ) - strlen( newcomments ), 
+						"  %5d - %s\n", 
+						choice->value,choice->name );
 				}
 				break;
 			}
@@ -540,7 +547,7 @@ void EClass_ImportFromClass( eclass_t *e, GSList *l_classes, class_t *bc ){
 			e->color[1] = 0.5; // how about a nice bright pink, mmm, nice! :)
 			e->color[2] = 1;
 
-			sprintf( color, "(%f %f %f)", e->color[0], e->color[1], e->color[2] );
+			snprintf( color, sizeof( color ), "(%f %f %f)", e->color[0], e->color[1], e->color[2] );
 			e->texdef.SetName( color );
 		}
 	}
@@ -593,7 +600,7 @@ void Create_EClasses( GSList *l_classes ){
 			for ( i = 0 ; i < MAX_FLAGS ; i++ )
 			{
 				if ( *e->flagnames[i] ) {
-					sprintf( spawnline,"  %d - %s\n", 1 << i, e->flagnames[i] );
+					snprintf( spawnline, sizeof( spawnline ), "  %d - %s\n", 1 << i, e->flagnames[i] );
 					e->comments = addstr( e->comments, spawnline );
 				}
 			}
@@ -649,7 +656,7 @@ void Eclass_ScanFile( char *filename ){
 			}
 		} while ( token[0] != '@' );
 
-		strcpy( temp,token + 1 ); // skip the @
+		Q_strncpyz( temp, token + 1, sizeof( temp ) );// skip the @
 
 		classtype = CLASS_NOCLASS;
 		if ( !stricmp( temp,"BaseClass" ) ) {
@@ -670,7 +677,7 @@ void Eclass_ScanFile( char *filename ){
 			while ( 1 )
 			{
 				GetTokenExtra( false, "(", false ); // option or =
-				strcpy( token_debug,token );
+				Q_strncpyz( token_debug, token, sizeof( token_debug ) );
 
 				if ( !strcmp( token, "=" ) ) {
 					UnGetToken();
@@ -707,7 +714,7 @@ void Eclass_ScanFile( char *filename ){
 							GetToken( false );
 							h = atof( token );
 							GetToken( false ); // number) or number ,
-							strcpy( temp,token );
+							Q_strncpyz( temp, token, sizeof( temp ) );
 							len = strlen( temp );
 							if ( temp[len - 1] == ')' ) {
 								sizedone = true;
@@ -765,7 +772,7 @@ void Eclass_ScanFile( char *filename ){
 								newclass->color[1] /= 255;
 							}
 							GetToken( false );
-							strcpy( temp,token );
+							Q_strncpyz( temp, token, sizeof( temp ) );
 							len = strlen( temp );
 							if ( temp[len - 1] == ')' ) {
 								temp[len - 1] = 0;
@@ -805,7 +812,7 @@ void Eclass_ScanFile( char *filename ){
 			}
 
 			GetToken( false ); // =
-			strcpy( token_debug,token );
+			Q_strncpyz( token_debug, token, sizeof( token_debug ) );
 			if ( !strcmp( token, "=" ) ) {
 				GetToken( false );
 				newclass->classname = strdup( token );
@@ -840,7 +847,8 @@ void Eclass_ScanFile( char *filename ){
 						}
 						// parse the data and build the option_t
 
-						strcpy( temp,token );
+						Q_strncpyz( temp, token, sizeof( temp ) );
+
 						len = strlen( temp );
 						char *ptr = strchr( temp,'(' );
 
@@ -884,7 +892,7 @@ void Eclass_ScanFile( char *filename ){
 								break;
 							}
 							GetToken( false ); // :
-							strcpy( token_debug,token );
+							Q_strncpyz( token_debug, token, sizeof( token_debug ) );
 							if ( ( token[0] == ':' ) && ( strlen( token ) > 1 ) ) {
 								newoption->optioninfo = strdup( token + 1 );
 							}
@@ -910,17 +918,17 @@ void Eclass_ScanFile( char *filename ){
 
 						case OPTION_CHOICES:
 							GetTokenExtra( false, ":", true ); // : or :"something like this" (bah!)
-							strcpy( token_debug,token );
+							Q_strncpyz( token_debug, token, sizeof( token_debug ) );
 							if ( ( token[0] == ':' ) && ( strlen( token ) > 1 ) ) {
 								if ( token[1] == '\"' ) {
-									strcpy( temp,token + 2 );
+									Q_strncpyz( temp, token + 2, sizeof( temp ) );
 									while ( 1 )
 									{
 										if ( !GetToken( false ) ) {
 											break;
 										}
-										strcat( temp," " );
+										strncat( temp, " ", sizeof( temp ) );
-										strcat( temp,token );
+										strncat( temp, token, sizeof( temp ) );
 										len = strlen( temp );
 										if ( temp[len - 1] == '\"' ) {
 											temp[len - 1] = 0;
@@ -936,7 +944,7 @@ void Eclass_ScanFile( char *filename ){
 								newoption->optioninfo = strdup( token );
 							}
 							GetToken( false ); // : or =
-							strcpy( token_debug,token );
+							Q_strncpyz( token_debug, token, sizeof( token_debug ) );
 							if ( !strcmp( token,":" ) ) {
 								GetToken( false );
 								newoption->optiondefault = strdup( token );
@@ -948,13 +956,13 @@ void Eclass_ScanFile( char *filename ){
 						// And Follow on...
 						case OPTION_FLAGS:
 							GetToken( false ); // : or =
-							strcpy( token_debug,token );
+							Q_strncpyz( token_debug, token, sizeof( token_debug ) );
 							if ( strcmp( token,"=" ) ) { // missing ?
 								break;
 							}
 
 							GetToken( true ); // [
-							strcpy( token_debug,token );
+							Q_strncpyz( token_debug, token, sizeof( token_debug ) );
 							if ( strcmp( token,"[" ) ) { // missing ?
 								break;
 							}
@@ -963,12 +971,12 @@ void Eclass_ScanFile( char *filename ){
 							while ( 1 )
 							{
 								GetTokenExtra( true, ":", true ); // "]" or "number", or "number:"
-								strcpy( token_debug,token );
+								Q_strncpyz( token_debug, token, sizeof( token_debug ) );
 								if ( !strcmp( token, "]" ) ) { // no more ?
 									optioncomplete = true;
 									break;
 								}
-								strcpy( temp,token );
+								Q_strncpyz( temp, token, sizeof( temp ) );
 								len = strlen( temp );
 								if ( temp[len - 1] == ':' ) {
 									temp[len - 1] = 0;
@@ -1061,21 +1069,21 @@ void Eclass_ScanFile( char *filename ){
 			Sys_Printf( "%s", (char *)tmp->data );
 		}
 		if ( tmpclass->gotsize ) {
-			sprintf( temp,"(%.0f %.0f %.0f) - (%.0f %.0f %.0f)",tmpclass->boundingbox[0][0],
+			snprintf( temp, sizeof( temp ),"(%.0f %.0f %.0f) - (%.0f %.0f %.0f)",tmpclass->boundingbox[0][0],
 					 tmpclass->boundingbox[0][1],
 					 tmpclass->boundingbox[0][2],
 					 tmpclass->boundingbox[1][0],
 					 tmpclass->boundingbox[1][1],
 					 tmpclass->boundingbox[1][2] );
 		}
-		else{ strcpy( temp,"No Size" ); }
+		else{ Q_strncpyz( temp, "No Size", sizeof( temp ) ); }
 		Sys_Printf( ") '%s' Size: %s",tmpclass->description ? tmpclass->description : "No description",temp );
 		if ( tmpclass->gotcolor ) {
-			sprintf( temp,"(%d %d %d)",tmpclass->color[0],
+			snprintf( temp, sizeof( temp ), "(%d %d %d)", tmpclass->color[0],
 					 tmpclass->color[1],
 					 tmpclass->color[2] );
 		}
-		else{ strcpy( temp,"No Color" ); }
+		else{ Q_strncpyz( temp, "No Color", sizeof( temp ) ); }
 		Sys_Printf( " Color: %s Options:\n",temp );
 		if ( !tmpclass->l_optionlist ) {
 			Sys_Printf( "  No Options\n" );

plugins/imagem8/m8.cpp

@@ -35,17 +35,17 @@ void LoadM8( const char *name, unsigned char **pic, int *width, int *height ){
 	unsigned char   *palette_ent, *buf_temp;
 	unsigned char       *buffer, *m8_file_buffer;
 
-	strcpy( text_buf, name );
+	Q_strncpyz( text_buf, name, sizeof( text_buf ) );
 	text_dot_pos = strchr( text_buf, '.' );
 	if ( text_dot_pos ) {
 		*text_dot_pos = 0;
 	}
 	// Fix for .pcx.m8 extention
-	strcat( text_buf, ".pcx.m8" );
+	strncat( text_buf, ".pcx.m8", sizeof( text_buf ) );
 
 	// open file
 	if ( ( length = vfsLoadFile( (char *) text_buf, (void **) &m8_file_buffer, 0 ) ) == (unsigned int) -1 ) {
-		strcpy( text_buf, name );
+		Q_strncpyz( text_buf, name, sizeof( text_buf ) );
 		for ( i = ( strlen( text_buf ) - 1 ); i > 0; i-- )
 		{
 			if ( text_buf[i] == '.' ) {
@@ -53,7 +53,7 @@ void LoadM8( const char *name, unsigned char **pic, int *width, int *height ){
 				break;
 			}
 		}
-		strcat( text_buf, ".m8" );
+		strncat( text_buf, ".m8", sizeof( text_buf ) );
 		if ( ( length = vfsLoadFile( (char *) text_buf, (void **) &m8_file_buffer, 0 ) ) == (unsigned int) -1 ) {
 			Sys_Printf( "Unable to open file %s\n",name );
 			return;

plugins/map/parse.cpp

@@ -30,7 +30,7 @@
 #include "plugin.h"
 
 // cmdlib
-extern void ExtractFileName( const char *path, char *dest );
+extern void ExtractFileName( const char *path, char *dest, size_t size );
 
 extern int g_MapVersion;
 int abortcode; // see imap.h for values.
@@ -65,7 +65,7 @@ void BuildWadList( char *wadstr ){
 
 	g_WadList = NULL;
 
-	strcpy( wads,wadstr );
+	Q_strncpyz( wads, wadstr, sizeof( wads ) );
 	QE_ConvertDOSToUnixName( wads,wads );
 
 	// ok, we got the list of ; delimited wads, now split it into a GSList that contains
@@ -81,7 +81,7 @@ void BuildWadList( char *wadstr ){
 
 		}
 		if ( strchr( p1,'/' ) || strchr( p1,'\\' ) ) {
-			ExtractFileName( p1,cleanwadname );
+			ExtractFileName( p1, cleanwadname, sizeof( cleanwadname ) );
 
 			trim( cleanwadname );
 
@@ -202,7 +202,7 @@ void Patch_Parse( patchMesh_t *pPatch ){
 	GetToken( true );
 	str = new char[strlen( token ) + 10];
 	strcpy( str, "textures/" );
-	strcpy( str + 9, token );
+	Q_strncpyz( str + 9, token, strlen( token ) + 10 - 9 );
 	pPatch->pShader = QERApp_Shader_ForName( str );
 	pPatch->d_texture = pPatch->pShader->getTexture();
 	delete [] str;
@@ -568,7 +568,7 @@ void Entity_Parse( entity_t *pEntity ){
 		}
 		else {
 
-			strcpy( temptoken, token );
+			Q_strncpyz( temptoken, token, sizeof( temptoken ) );
 			GetToken( false );
 
 			SetKeyValue( pEntity, temptoken, token );

plugins/mapxml/xmlparse.cpp

@@ -218,7 +218,7 @@ void HandleXMLError( void* ctxt, const char* text, ... ){
 	static char buf[32768];
 
 	va_start( argptr,text );
-	vsprintf( buf, text, argptr );
+	vsnprintf( buf, sizeof( buf ), text, argptr );
 	Sys_FPrintf( SYS_ERR, "XML %s\n", buf );
 	va_end( argptr );
 }

plugins/mapxml/xmlwrite.cpp

@@ -40,15 +40,15 @@ char *str_append_token( char *str1, const char *str2 ){
 	return str;
 }
 
-void str_from_float( char *buf, float f ){
+void str_from_float( char *buf, float f, size_t length ){
 	if ( f == (int)f ) {
-		sprintf( buf, "%i", (int)f );
+		snprintf( buf, length, "%i", (int)f );
 	}
-	else{ sprintf( buf, "%f", f ); }
+	else{ snprintf( buf, length, "%f", f ); }
 }
 
 void Patch_XMLWrite( patchMesh_t *pPatch, xmlNodePtr surface ){
-	char buf[16];
+	char buf[64];
 	char *str;
 	int i, j;
 	xmlNodePtr node;
@@ -62,29 +62,29 @@ void Patch_XMLWrite( patchMesh_t *pPatch, xmlNodePtr surface ){
 	{
 		for ( j = 0; j < pPatch->height; j++ )
 		{
-			str_from_float( buf, pPatch->ctrl[i][j].xyz[0] );
+			str_from_float( buf, pPatch->ctrl[i][j].xyz[0], sizeof( buf ) );
 			str = str_append_token( str, buf );
-			str_from_float( buf, pPatch->ctrl[i][j].xyz[1] );
+			str_from_float( buf, pPatch->ctrl[i][j].xyz[1], sizeof( buf ) );
 			str = str_append_token( str, buf );
-			str_from_float( buf, pPatch->ctrl[i][j].xyz[2] );
+			str_from_float( buf, pPatch->ctrl[i][j].xyz[2], sizeof( buf ) );
 			str = str_append_token( str, buf );
-			str_from_float( buf, pPatch->ctrl[i][j].st[0] );
+			str_from_float( buf, pPatch->ctrl[i][j].st[0], sizeof( buf ) );
 			str = str_append_token( str, buf );
-			str_from_float( buf, pPatch->ctrl[i][j].st[1] );
+			str_from_float( buf, pPatch->ctrl[i][j].st[1], sizeof( buf ) );
 			str = str_append_token( str, buf );
 		}
 	}
 
 	node = xmlNewChild( surface, NULL, (xmlChar *)"matrix", (xmlChar *)str );
 	delete [] str;
-	sprintf( buf, "%i", pPatch->width );
+	snprintf( buf, sizeof( buf ), "%i", pPatch->width );
 	xmlSetProp( node, (xmlChar *)"width", (xmlChar *)buf );
-	sprintf( buf, "%i", pPatch->height );
+	snprintf( buf, sizeof( buf ), "%i", pPatch->height );
 	xmlSetProp( node, (xmlChar *)"height", (xmlChar *)buf );
 }
 
 void Face_XMLWrite( face_t *face, xmlNodePtr surface, bool bAlternateTexdef = false ){
-	char buf[16];
+	char buf[64];
 	xmlNodePtr node;
 	int i, j;
 	char *str;
@@ -98,7 +98,7 @@ void Face_XMLWrite( face_t *face, xmlNodePtr surface, bool bAlternateTexdef = fa
 	{
 		for ( j = 0 ; j < 3 ; j++ )
 		{
-			str_from_float( buf, face->planepts[i][j] );
+			str_from_float( buf, face->planepts[i][j], sizeof( buf ) );
 			str = str_append_token( str, buf );
 		}
 	}
@@ -108,15 +108,15 @@ void Face_XMLWrite( face_t *face, xmlNodePtr surface, bool bAlternateTexdef = fa
 
 	if ( !bAlternateTexdef ) {
 		// write texdef
-		sprintf( buf, "%i", (int)face->texdef.shift[0] );
+		snprintf( buf, sizeof( buf ), "%i", (int)face->texdef.shift[0] );
 		str = str_append_token( NULL, buf );
-		sprintf( buf, "%i", (int)face->texdef.shift[1] );
+		snprintf( buf, sizeof( buf ), "%i", (int)face->texdef.shift[1] );
 		str = str_append_token( str, buf );
-		sprintf( buf, "%i", (int)face->texdef.rotate );
+		snprintf( buf, sizeof( buf ), "%i", (int)face->texdef.rotate );
 		str = str_append_token( str, buf );
-		sprintf( buf, "%f", face->texdef.scale[0] );
+		snprintf( buf, sizeof( buf ), "%f", face->texdef.scale[0] );
 		str = str_append_token( str, buf );
-		sprintf( buf, "%f", face->texdef.scale[1] );
+		snprintf( buf, sizeof( buf ), "%f", face->texdef.scale[1] );
 		str = str_append_token( str, buf );
 
 		node = xmlNewChild( surface, NULL, (xmlChar *)"texdef", (xmlChar *)str );
@@ -130,7 +130,7 @@ void Face_XMLWrite( face_t *face, xmlNodePtr surface, bool bAlternateTexdef = fa
 		{
 			for ( j = 0 ; j < 3 ; j++ )
 			{
-				str_from_float( buf, face->brushprimit_texdef.coords[i][j] );
+				str_from_float( buf, face->brushprimit_texdef.coords[i][j], sizeof( buf ) );
 				str = str_append_token( str, buf );
 			}
 		}
@@ -139,11 +139,11 @@ void Face_XMLWrite( face_t *face, xmlNodePtr surface, bool bAlternateTexdef = fa
 	}
 
 	// write flags
-	sprintf( buf, "%i", face->texdef.contents );
+	snprintf( buf, sizeof( buf ), "%i", face->texdef.contents );
 	str = str_append_token( NULL, buf );
-	sprintf( buf, "%i", face->texdef.flags );
+	snprintf( buf, sizeof( buf ), "%i", face->texdef.flags );
 	str = str_append_token( str, buf );
-	sprintf( buf, "%i", face->texdef.value );
+	snprintf( buf, sizeof( buf ), "%i", face->texdef.value );
 	str = str_append_token( str, buf );
 
 	node = xmlNewChild( surface, NULL, (xmlChar *)"flags", (xmlChar *)str );

plugins/model/plugin.cpp

@@ -142,7 +142,7 @@ void init_filetypes(){
 				char buf[16];
 				buf[0] = '*';
 				buf[1] = '.';
-				strcpy( buf + 2, *ext );
+				Q_strncpyz( buf + 2, *ext, sizeof( buf ) - 2 );
 				GetFileTypeRegistry()->addType( MODEL_MAJOR, filetype_t( module->displayName, buf ) );
 			}
 		}
@@ -178,15 +178,15 @@ extern "C" void QERPlug_Dispatch( const char *p, vec3_t vMin, vec3_t vMax, bool
 	else if ( !strcmp( p, "About" ) ) {
 		const picoModule_t** modules = PicoModuleList( NULL );
 		char about_buf[1024];
-		strncpy( about_buf, PLUGIN_ABOUT, sizeof( about_buf ) - 1 );
+		Q_strncpyz( about_buf, PLUGIN_ABOUT, sizeof( about_buf ) );
 		while ( *modules != NULL ) {
 			const picoModule_t* module = *modules++;
-			strncat( about_buf, module->displayName, sizeof( about_buf ) - 1 );
+			strncat( about_buf, module->displayName, sizeof( about_buf ) );
-			strncat( about_buf, " (", sizeof( about_buf ) - 1 );
+			strncat( about_buf, " (", sizeof( about_buf ) );
-			strncat( about_buf, module->defaultExts[0], sizeof( about_buf ) - 1 );
+			strncat( about_buf, module->defaultExts[0], sizeof( about_buf ) );
-			strncat( about_buf, ")\n\t", sizeof( about_buf ) - 1 );
+			strncat( about_buf, ")\n\t", sizeof( about_buf ) );
-			strncat( about_buf, module->copyright, sizeof( about_buf ) - 1 );
+			strncat( about_buf, module->copyright, sizeof( about_buf ) );
-			strncat( about_buf, "\n", sizeof( about_buf ) - 1 );
+			strncat( about_buf, "\n", sizeof( about_buf ) );
 		}
 		g_FuncTable.m_pfnMessageBox( NULL, about_buf, "About", MB_OK, NULL );
 	}

plugins/model/remap.cpp

@@ -164,7 +164,7 @@ void add_remap( const char *remap ){
 	else {
 		pRemap = new remap_t;
 
-		strncpy( pRemap->m_remapbuff, remap, sizeof( pRemap->m_remapbuff ) );
+		Q_strncpyz( pRemap->m_remapbuff, remap, sizeof( pRemap->m_remapbuff ) );
 
 		pRemap->m_remapbuff[ch - remap] = '\0';
 

plugins/shaders/shaders.cpp

@@ -71,7 +71,7 @@ const char *WINAPI QERApp_CleanTextureName( const char *name, bool bAddTexture =
 	}
 #endif
 
-	strcpy( stdName, name );
+	Q_strncpyz( stdName, name, sizeof( stdName ) );
 	g_FuncTable.m_pfnQE_ConvertDOSToUnixName( stdName, stdName );
 	if ( stdName[strlen( name ) - 4] == '.' ) {
 		// strip extension
@@ -80,8 +80,8 @@ const char *WINAPI QERApp_CleanTextureName( const char *name, bool bAddTexture =
 
 	if ( bAddTexture ) {
 		char aux[QER_MAX_NAMELEN];
-		sprintf( aux, "textures/%s", stdName );
+		snprintf( aux, sizeof( aux ), "textures/%s", stdName );
-		strcpy( stdName, aux );
+		Q_strncpyz( stdName, aux, sizeof( stdName ) );
 	}
 	return stdName;
 }
@@ -226,7 +226,7 @@ CPtrArray PatchShaders;
 void PushPatch( patchMesh_t * patch ){
 	patchEntry_t *pEntry = new patchEntry_s;
 	pEntry->p = patch;
-	strcpy( pEntry->name, patch->pShader->getName() );
+	Q_strncpyz( pEntry->name, patch->pShader->getName(), sizeof( pEntry->name ) );
 	PatchShaders.Add( pEntry );
 }
 
@@ -734,7 +734,7 @@ qtexture_t *WINAPI QERApp_Try_Texture_ForName( const char *name ){
 	}
 	g_free( pPixels );
 
-	strcpy( q->name, name );
+	Q_strncpyz( q->name, name, sizeof( q->name ) );
 	// only strip extension if extension there is!
 	if ( q->name[strlen( q->name ) - 4] == '.' ) {
 		q->name[strlen( q->name ) - 4] = '\0';
@@ -792,7 +792,7 @@ void CShader::CreateColor( const char *name ){
 	// copy this one
 	qtexture_t *q2 = new qtexture_t;
 	memcpy( q2, q1, sizeof( qtexture_t ) );
-	strcpy( q2->name, m_strTextureName.GetBuffer() );
+	Q_strncpyz( q2->name, m_strTextureName.GetBuffer(), sizeof( q2->name ) );
 	VectorCopy( m_vColor, q2->color );
 	m_pTexture = q2;
 }

plugins/surface/surfacedialog.cpp

@@ -201,7 +201,7 @@ void IsFaceConflicting(){
 
 	tmp_texdef = &get_texdef_face_list()->texdef;
 
-	strcpy( texture_name, tmp_texdef->GetName() );
+	Q_strncpyz( texture_name, tmp_texdef->GetName(), sizeof( texture_name ) );
 
 	texdef_SI_values.shift[0] = tmp_texdef->shift[0];
 	texdef_SI_values.shift[1] = tmp_texdef->shift[1];
@@ -288,6 +288,7 @@ static void PopulateTextureComboList(){
 	texdef_to_face_t* temp_texdef_face_list;
 	char blank[1];
 	GList *items = NULL;
+	GList *lst;
 	int num_of_list_items = 0;
 
 	blank[0] = 0;
@@ -295,14 +296,14 @@ static void PopulateTextureComboList(){
 	if ( texdef_face_list_empty() ) {
 		items = g_list_append( items, (gpointer) blank );
 		// For Texture Entry, activate only on entry change
-		strcpy( old_texture_entry, blank );
+		Q_strncpyz( old_texture_entry, blank, sizeof( old_texture_entry ) );
 	}
 	else if ( !is_TextureName_conflicting ) {
 		temp_texdef_face_list = get_texdef_face_list();
 		tmp_texdef = (texdef_t *) &get_texdef_face_list()->texdef;
 		items = g_list_append( items, (gpointer) tmp_texdef->GetName() );
 		// For Texture Entry, activate only on entry change
-		strcpy( old_texture_entry, tmp_texdef->GetName() );
+		Q_strncpyz( old_texture_entry, tmp_texdef->GetName(), sizeof( old_texture_entry ) );
 	}
 	else
 	{
@@ -322,7 +323,7 @@ static void PopulateTextureComboList(){
 		// If this isn't added last (to the top of the list), g_list_find freaks.
 		items = g_list_prepend( items, (gpointer) blank );
 		// For Texture Entry, activate only on entry change
-		strcpy( old_texture_entry, blank );
+		Q_strncpyz( old_texture_entry, blank, sizeof( old_texture_entry ) );
 	}
 
 	gtk_combo_set_popdown_strings( GTK_COMBO( texture_combo ), items );
@@ -1232,7 +1233,7 @@ void on_texture_combo_entry_activate( GtkEntry *entry, gpointer user_data ){
 
 	if ( !texdef_face_list_empty() && g_bListenChanged ) {
 		// activate only on entry change
-		strcpy( text, gtk_entry_get_text( entry ) );
+		Q_strncpyz( text, gtk_entry_get_text( entry ), sizeof( text ) );
 		if ( strcmp( old_texture_entry, text ) ) {
 			// Check for spaces in shader name
 			if ( text[0] <= ' ' || strchr( text, ' ' ) ) {
@@ -1244,7 +1245,7 @@ void on_texture_combo_entry_activate( GtkEntry *entry, gpointer user_data ){
 				{
 					tmp_texdef = (texdef_t *) &temp_texdef_face_list->texdef;
 					tmp_orig_texdef = (texdef_t *) &temp_texdef_face_list->orig_texdef;
-					strcpy( old_texture_entry, text );
+					Q_strncpyz( old_texture_entry, text, sizeof( old_texture_entry ) );
 					tmp_texdef->SetName( text );
 				}
 				GetTexMods();

plugins/surface_idtech2/surfacedialog.cpp

@@ -161,7 +161,7 @@ void IsFaceConflicting(){
 
 	tmp_texdef = &get_texdef_face_list()->texdef;
 
-	strcpy( texture_name, tmp_texdef->GetName() );
+	Q_strncpyz( texture_name, tmp_texdef->GetName(), sizeof( texture_name ) );
 
 	texdef_SI_values.shift[0] = tmp_texdef->shift[0];
 	texdef_SI_values.shift[1] = tmp_texdef->shift[1];
@@ -260,14 +260,14 @@ static void PopulateTextureComboList(){
 	if ( texdef_face_list_empty() ) {
 		items = g_list_append( items, (gpointer) blank );
 		// For Texture Entry, activate only on entry change
-		strcpy( old_texture_entry, blank );
+		Q_strncpyz( old_texture_entry, blank, sizeof( old_texture_entry ) );
 	}
 	else if ( !is_TextureName_conflicting ) {
 		temp_texdef_face_list = get_texdef_face_list();
 		tmp_texdef = (texdef_t *) &get_texdef_face_list()->texdef;
 		items = g_list_append( items, (gpointer) tmp_texdef->GetName() );
 		// For Texture Entry, activate only on entry change
-		strcpy( old_texture_entry, tmp_texdef->GetName() );
+		Q_strncpyz( old_texture_entry, tmp_texdef->GetName(), sizeof( old_texture_entry ) );
 	}
 	else
 	{
@@ -287,7 +287,7 @@ static void PopulateTextureComboList(){
 		// If this isn't added last (to the top of the list), g_list_find freaks.
 		items = g_list_prepend( items, (gpointer) blank );
 		// For Texture Entry, activate only on entry change
-		strcpy( old_texture_entry, blank );
+		Q_strncpyz( old_texture_entry, blank, sizeof( old_texture_entry ) );
 	}
 
 	gtk_combo_set_popdown_strings( GTK_COMBO( texture_combo ), items );
@@ -879,7 +879,7 @@ void on_texture_combo_entry_activate( GtkEntry *entry, gpointer user_data ){
 
 	if ( !texdef_face_list_empty() && g_bListenChanged ) {
 		// activate only on entry change
-		strcpy( text, gtk_entry_get_text( entry ) );
+		Q_strncpyz( text, gtk_entry_get_text( entry ), sizeof( text ) );
 		if ( strcmp( old_texture_entry, text ) ) {
 			// Check for spaces in shader name
 			if ( text[0] <= ' ' || strchr( text, ' ' ) ) {
@@ -891,7 +891,7 @@ void on_texture_combo_entry_activate( GtkEntry *entry, gpointer user_data ){
 				{
 					tmp_texdef = (texdef_t *) &temp_texdef_face_list->texdef;
 					tmp_orig_texdef = (texdef_t *) &temp_texdef_face_list->orig_texdef;
-					strcpy( old_texture_entry, text );
+					Q_strncpyz( old_texture_entry, text, sizeof( old_texture_entry ) );
 					tmp_texdef->SetName( text );
 				}
 				GetTexMods();

plugins/surface_idtech2/surfaceflags.cpp

@@ -33,8 +33,7 @@ GtkWidget *notebook1;
 // 32 bit is the max
 #define MAX_BUTTONS 32
 
-#ifdef _WIN32
+#if defined(_MSC_VER) && _MSC_VER<1900 && !(defined snprintf)
-// TTimo: THIS IS UGLY
 #define snprintf _snprintf
 #endif
 
@@ -87,7 +86,7 @@ void set_surface_flags_button_state( texdef_to_face_t *texdef_face_list, bool b_
 	int diff_contents = 0;
 	int diff_flags = 0;
 	gboolean diff_value = FALSE;
-	char tex_buff[11];
+	char tex_buff[16];
 	texdef_t* tmp_texdef;
 	texdef_to_face_t* temp_texdef_face_list;
 	int i;
@@ -164,7 +163,7 @@ void set_surface_flags_button_state( texdef_to_face_t *texdef_face_list, bool b_
 	}
 	else {
 		working_value = value;
-		sprintf( tex_buff, "%d", value );
+		snprintf( tex_buff, sizeof( tex_buff ), "%d", value );
 		gtk_entry_set_text( (GtkEntry *)value_entry, tex_buff );
 	}
 
@@ -302,7 +301,7 @@ GtkWidget* create_SurfaceFlagsFrame( GtkWidget* surfacedialog_widget ){
 	GtkWidget *label6;
 	int i, x, y;
 	const char *buttonLabel;
-	char buffer[8];
+	char buffer[16];
 
 	frame1 = gtk_frame_new( _( "Flags" ) );
 	gtk_widget_show( frame1 );
@@ -334,7 +333,7 @@ GtkWidget* create_SurfaceFlagsFrame( GtkWidget* surfacedialog_widget ){
 			y++;
 		}
 		x = i % 4;
-		snprintf( buffer, sizeof( buffer ) - 1, "surf%i", i + 1 );
+		snprintf( buffer, sizeof( buffer ), "surf%i", i + 1 );
 		buttonLabel = g_FuncTable.m_pfnReadProjectKey( buffer );
 		//Sys_Printf( "%s: %s\n", buffer, buttonLabel );
 		surface_buttons[i] = gtk_toggle_button_new_with_label( buttonLabel );
@@ -392,7 +391,7 @@ GtkWidget* create_SurfaceFlagsFrame( GtkWidget* surfacedialog_widget ){
 			y++;
 		}
 		x = i % 4;
-		snprintf( buffer, sizeof( buffer ) - 1, "cont%i", i + 1 );
+		snprintf( buffer, sizeof( buffer ), "cont%i", i + 1 );
 		buttonLabel = g_FuncTable.m_pfnReadProjectKey( buffer );
 		content_buttons[i] = gtk_toggle_button_new_with_label( buttonLabel );
 		gtk_signal_connect( GTK_OBJECT( content_buttons[i] ), "toggled", GTK_SIGNAL_FUNC( on_content_button_toggled ), GINT_TO_POINTER( 1 << i ) );

plugins/vfspak/vfs.cpp

@@ -93,11 +93,11 @@ static bool g_bUsePak = true;
 // =============================================================================
 // Static functions
 
-static void vfsAddSlash( char *str ){
+static void vfsAddSlash( char *str, size_t length ){
 	int n = strlen( str );
 	if ( n > 0 ) {
 		if ( str[n - 1] != '\\' && str[n - 1] != '/' ) {
-			strcat( str, "/" );
+			strncat( str, "/", length );
 		}
 	}
 }
@@ -182,10 +182,10 @@ static GSList* vfsGetListInternal( const char *dir, const char *ext, bool direct
 
 	dirname[0] = '\0';
 	if ( dir != NULL ) {
-		strcat( dirname, dir );
+		strncat( dirname, dir, sizeof( dirname ) );
 		strlwr( dirname );
 		vfsFixDOSName( dirname );
-		vfsAddSlash( dirname );
+		vfsAddSlash( dirname, sizeof( dirname ) );
 		Sys_Printf( "vfs dirname_1: %s\n", dirname );
 	}
 	//else
@@ -193,7 +193,7 @@ static GSList* vfsGetListInternal( const char *dir, const char *ext, bool direct
 	dirlen = strlen( dirname );
 
 	if ( ext != NULL ) {
-		strcpy( extension, ext );
+		Q_strncpyz( extension, ext, sizeof( extension ) );
 	}
 	else{
 		extension[0] = '\0';
@@ -259,11 +259,11 @@ static GSList* vfsGetListInternal( const char *dir, const char *ext, bool direct
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( dirname, g_strDirs[i] );
+		Q_strncpyz( dirname, g_strDirs[i], sizeof( dirname ) );
-		strcat( dirname, dir );
+		strncat( dirname, dir, sizeof( dirname ) );
 		strlwr( dirname );
 		vfsFixDOSName( dirname );
-		vfsAddSlash( dirname );
+		vfsAddSlash( dirname, sizeof( dirname ) );
 
 		diskdir = g_dir_open( dirname, 0, NULL );
 
@@ -279,7 +279,7 @@ static GSList* vfsGetListInternal( const char *dir, const char *ext, bool direct
 					continue;
 				}
 
-				sprintf( filename, "%s%s", dirname, name );
+				snprintf( filename, sizeof( filename ), "%s%s", dirname, name );
 				stat( filename, &st );
 				Sys_Printf( "vfs FileName: %s\n", filename );
 
@@ -381,9 +381,9 @@ void vfsInitDirectory( const char *path ){
 		return;
 	}
 
-	strcpy( g_strDirs[g_numDirs], path );
+	Q_strncpyz( g_strDirs[g_numDirs], path, sizeof( g_strDirs[g_numDirs] ) );
 	vfsFixDOSName( g_strDirs[g_numDirs] );
-	vfsAddSlash( g_strDirs[g_numDirs] );
+	vfsAddSlash( g_strDirs[g_numDirs], sizeof( g_strDirs[g_numDirs] ) );
 	g_numDirs++;
 
 	if ( g_bUsePak ) {
@@ -417,9 +417,9 @@ void vfsInitDirectory( const char *path ){
 			while ( dirlist )
 			{
 				GSList *cur = dirlist;
-				char* name = (char*)cur->data;
+				gchar* name = (gchar*)cur->data;
 
-				sprintf( filename, "%s/%s", path, name );
+				snprintf( filename, sizeof( filename ), "%s/%s", path, name );
 				vfsInitPakFile( filename );
 
 				g_free( name );
@@ -471,7 +471,7 @@ int vfsGetFileCount( const char *filename, int flag ){
 	char fixed[NAME_MAX], tmp[NAME_MAX];
 	GSList *lst;
 
-	strcpy( fixed, filename );
+	Q_strncpyz( fixed, filename, sizeof( fixed ) );
 	vfsFixDOSName( fixed );
 	strlwr( fixed );
 
@@ -486,8 +486,8 @@ int vfsGetFileCount( const char *filename, int flag ){
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( tmp, g_strDirs[i] );
+		Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-		strcat( tmp, fixed );
+		strncat( tmp, fixed, sizeof( tmp ) );
 		if ( access( tmp, R_OK ) == 0 ) {
 			count++;
 		}
@@ -503,14 +503,14 @@ int vfsLoadFile( const char *filename, void **bufferptr, int index ){
 	GSList *lst;
 
 	*bufferptr = NULL;
-	strcpy( fixed, filename );
+	Q_strncpyz( fixed, filename, sizeof( fixed ) );
 	vfsFixDOSName( fixed );
 	strlwr( fixed );
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( tmp, g_strDirs[i] );
+		Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-		strcat( tmp, filename );
+		strncat( tmp, filename, sizeof( tmp ) );
 		if ( access( tmp, R_OK ) == 0 ) {
 			if ( count == index ) {
 				long len;
@@ -646,11 +646,11 @@ char* vfsExtractRelativePath_short( const char *in, bool shorten ){
 	}
 	else
 	{
-		strcpy( l_in,in );
+		Q_strncpyz( l_in, in, sizeof( l_in ) );
 	}
 	vfsCleanFileName( l_in );
 #else
-	strcpy( l_in, in );
+	Q_strncpyz( l_in, in, sizeof( l_in ) );
 	vfsCleanFileName( l_in );
 #endif // ifdef WIN32
 
@@ -661,7 +661,7 @@ char* vfsExtractRelativePath_short( const char *in, bool shorten ){
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( check,g_strDirs[i] );
+		Q_strncpyz( check, g_strDirs[i], sizeof( check ) );
 		vfsCleanFileName( check );
 #ifdef DBG_RLTPATH
 		Sys_Printf( "Matching against %s\n", check );
@@ -669,7 +669,7 @@ char* vfsExtractRelativePath_short( const char *in, bool shorten ){
 
 		// try to find a match
 		if ( strstr( l_in, check ) ) {
-			strcpy( out,l_in + strlen( check ) + 1 );
+			Q_strncpyz( out, l_in + strlen( check ) + 1, sizeof( out ) );
 			break;
 		}
 
@@ -701,7 +701,7 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 		char fixed[NAME_MAX];
 		GSList *lst;
 
-		strcpy( fixed, in );
+		Q_strncpyz( fixed, in, sizeof( fixed ) );
 		vfsFixDOSName( fixed );
 		strlwr( fixed );
 
@@ -716,7 +716,7 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 				lastptr = ptr + 1;
 
 			if ( strcmp( lastptr, fixed ) == 0 ) {
-				strncpy( out,file->name,PATH_MAX );
+				Q_strncpyz( out, file->name, sizeof( out ) );
 				return out;
 			}
 		}
@@ -726,11 +726,11 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 	if ( !flag || ( flag & VFS_SEARCH_DIR ) ) {
 		for ( i = 0; i < g_numDirs; i++ )
 		{
-			strcpy( tmp, g_strDirs[i] );
+			Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-			strcat( tmp, in );
+			strncat( tmp, in, sizeof( tmp ) );
 			if ( access( tmp, R_OK ) == 0 ) {
 				if ( count == index ) {
-					strcpy( out, tmp );
+					Q_strncpyz( out, tmp, sizeof( out ) );
 					return out;
 				}
 				count++;
@@ -762,7 +762,7 @@ char* vfsExtractRelativePath( const char *in ){
 				}
 			}
 			// this is the clean, not short version
-			strcpy( out, in );
+			Q_strncpyz( out, in, sizeof( out ) );
 			vfsCleanFileName( out );
 			for ( i = 0; i <= count; i++ )
 			{

plugins/vfspk3/vfs.cpp

@@ -86,11 +86,11 @@ static bool g_bUsePak = true;
 // =============================================================================
 // Static functions
 
-static void vfsAddSlash( char *str ){
+static void vfsAddSlash( char *str, size_t length ){
 	int n = strlen( str );
 	if ( n > 0 ) {
 		if ( str[n - 1] != '\\' && str[n - 1] != '/' ) {
-			strcat( str, "/" );
+			strncat( str, "/", length );
 		}
 	}
 }
@@ -174,10 +174,10 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 	int i;
 
 	if ( refdir != NULL ) {
-		strcpy( dirname, refdir );
+		Q_strncpyz( dirname, refdir, sizeof( dirname ) );
 		strlwr( dirname );
 		vfsFixDOSName( dirname );
-		vfsAddSlash( dirname );
+		vfsAddSlash( dirname, sizeof( dirname ) );
 	}
 	else{
 		dirname[0] = '\0';
@@ -185,7 +185,7 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 	dirlen = strlen( dirname );
 
 	if ( ext != NULL ) {
-		strcpy( extension, ext );
+		Q_strncpyz( extension, ext, sizeof( extension ) );
 	}
 	else{
 		extension[0] = '\0';
@@ -252,8 +252,8 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( basedir, g_strDirs[i] );
+		Q_strncpyz( basedir, g_strDirs[i], sizeof( basedir ) );
-		strcat( basedir, dirname );
+		strncat( basedir, dirname, sizeof( basedir ) );
 
 		diskdir = g_dir_open( basedir, 0, NULL );
 
@@ -269,7 +269,7 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 					continue;
 				}
 
-				sprintf( filename, "%s%s", basedir, name );
+				snprintf( filename, sizeof( filename ), "%s%s", basedir, name );
 				stat( filename, &st );
 
 				if ( ( S_ISDIR( st.st_mode ) != 0 ) != directories ) {
@@ -394,9 +394,9 @@ void vfsInitDirectory( const char *path ){
 		iGameMode = 0;
 	}
 
-	strcpy( g_strDirs[g_numDirs], path );
+	Q_strncpyz( g_strDirs[g_numDirs], path, sizeof( g_strDirs[g_numDirs] ) );
 	vfsFixDOSName( g_strDirs[g_numDirs] );
-	vfsAddSlash( g_strDirs[g_numDirs] );
+	vfsAddSlash( g_strDirs[g_numDirs], sizeof( g_strDirs[g_numDirs] ) );
 	g_numDirs++;
 
 	if ( g_bUsePak ) {
@@ -472,7 +472,7 @@ void vfsInitDirectory( const char *path ){
 					break;
 				}
 
-				sprintf( filename, "%s/%s", path, name );
+				snprintf( filename, sizeof( filename ), "%s/%s", path, name );
 				vfsInitPakFile( filename );
 
 				g_free( name );
@@ -534,7 +534,7 @@ int vfsGetFileCount( const char *filename, int flag ){
 	char fixed[NAME_MAX], tmp[NAME_MAX];
 	GSList *lst;
 
-	strcpy( fixed, filename );
+	Q_strncpyz( fixed, filename, sizeof( fixed ) );
 	vfsFixDOSName( fixed );
 	strlwr( fixed );
 
@@ -552,8 +552,8 @@ int vfsGetFileCount( const char *filename, int flag ){
 	if ( !flag || ( flag & VFS_SEARCH_DIR ) ) {
 		for ( i = 0; i < g_numDirs; i++ )
 		{
-			strcpy( tmp, g_strDirs[i] );
+			Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-			strcat( tmp, fixed );
+			strncat( tmp, fixed, sizeof( tmp ) );
 			if ( access( tmp, R_OK ) == 0 ) {
 				count++;
 			}
@@ -598,14 +598,14 @@ int vfsLoadFile( const char *filename, void **bufferptr, int index ){
 	GSList *lst;
 
 	*bufferptr = NULL;
-	strcpy( fixed, filename );
+	Q_strncpyz( fixed, filename, sizeof( fixed ) );
 	vfsFixDOSName( fixed );
 	strlwr( fixed );
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( tmp, g_strDirs[i] );
+		Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-		strcat( tmp, filename );
+		strncat( tmp, filename, sizeof( tmp ) );
 		if ( access( tmp, R_OK ) == 0 ) {
 			if ( count == index ) {
 				return vfsLoadFullPathFile( tmp,bufferptr );
@@ -684,11 +684,11 @@ char* vfsExtractRelativePath_short( const char *in, bool shorten ){
 	}
 	else
 	{
-		strcpy( l_in,in );
+		Q_strncpyz( l_in, in, sizeof( l_in ) );
 	}
 	vfsCleanFileName( l_in );
 #else
-	strcpy( l_in, in );
+	Q_strncpyz( l_in, in, sizeof( l_in ) );
 	vfsCleanFileName( l_in );
 #endif // ifdef WIN32
 
@@ -699,7 +699,7 @@ char* vfsExtractRelativePath_short( const char *in, bool shorten ){
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( check,g_strDirs[i] );
+		Q_strncpyz( check, g_strDirs[i], sizeof( check ) );
 		vfsCleanFileName( check );
 #ifdef DBG_RLTPATH
 		Sys_Printf( "Matching against %s\n", check );
@@ -707,7 +707,7 @@ char* vfsExtractRelativePath_short( const char *in, bool shorten ){
 
 		// try to find a match
 		if ( strstr( l_in, check ) ) {
-			strcpy( out,l_in + strlen( check ) + 1 );
+			Q_strncpyz( out, l_in + strlen( check ) + 1, sizeof( out ) );
 			break;
 		}
 
@@ -747,7 +747,7 @@ char* vfsExtractRelativePath( const char *in ){
 				}
 			}
 			// this is the clean, not short version
-			strcpy( out, in );
+			Q_strncpyz( out, in, sizeof( out ) );
 			vfsCleanFileName( out );
 			for ( i = 0; i <= count; i++ )
 			{
@@ -788,7 +788,7 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 		char fixed[NAME_MAX];
 		GSList *lst;
 
-		strcpy( fixed, in );
+		Q_strncpyz( fixed, in, sizeof( fixed ) );
 		vfsFixDOSName( fixed );
 		strlwr( fixed );
 
@@ -803,7 +803,7 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 				lastptr = ptr + 1;
 
 			if ( strcmp( lastptr, fixed ) == 0 ) {
-				strncpy( out,file->name,PATH_MAX );
+				Q_strncpyz( out, file->name, sizeof( out ) );
 				return out;
 			}
 		}
@@ -813,11 +813,11 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 	if ( !flag || ( flag & VFS_SEARCH_DIR ) ) {
 		for ( i = 0; i < g_numDirs; i++ )
 		{
-			strcpy( tmp, g_strDirs[i] );
+			Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-			strcat( tmp, in );
+			strncat( tmp, in, sizeof( tmp ) );
 			if ( access( tmp, R_OK ) == 0 ) {
 				if ( count == index ) {
-					strcpy( out, tmp );
+					Q_strncpyz( out, tmp, sizeof( out ) );
 					return out;
 				}
 				count++;

plugins/vfsqlpk3/vfs.cpp

@@ -85,11 +85,11 @@ static bool g_bUsePak = true;
 // =============================================================================
 // Static functions
 
-static void vfsAddSlash( char *str ){
+static void vfsAddSlash( char *str, size_t length ){
 	int n = strlen( str );
 	if ( n > 0 ) {
 		if ( str[n - 1] != '\\' && str[n - 1] != '/' ) {
-			strcat( str, "/" );
+			strncat( str, "/", length );
 		}
 	}
 }
@@ -172,10 +172,10 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 	int i;
 
 	if ( refdir != NULL ) {
-		strcpy( dirname, refdir );
+		Q_strncpyz( dirname, refdir, sizeof( dirname ) );
 		strlwr( dirname );
 		vfsFixDOSName( dirname );
-		vfsAddSlash( dirname );
+		vfsAddSlash( dirname, sizeof( dirname ) );
 	}
 	else{
 		dirname[0] = '\0';
@@ -183,7 +183,7 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 	dirlen = strlen( dirname );
 
 	if ( ext != NULL ) {
-		strcpy( extension, ext );
+		Q_strncpyz( extension, ext, sizeof( extension ) );
 	}
 	else{
 		extension[0] = '\0';
@@ -250,8 +250,8 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( basedir, g_strDirs[i] );
+		Q_strncpyz( basedir, g_strDirs[i], sizeof( basedir ) );
-		strcat( basedir, dirname );
+		strncat( basedir, dirname, sizeof( basedir ) );
 
 		diskdir = g_dir_open( basedir, 0, NULL );
 
@@ -267,7 +267,7 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 					continue;
 				}
 
-				sprintf( filename, "%s%s", basedir, name );
+				snprintf( filename, sizeof( filename ), "%s%s", basedir, name );
 				stat( filename, &st );
 
 				if ( ( S_ISDIR( st.st_mode ) != 0 ) != directories ) {
@@ -392,9 +392,9 @@ void vfsInitDirectory( const char *path ){
 		iGameMode = 0;
 	}
 
-	strcpy( g_strDirs[g_numDirs], path );
+	Q_strncpyz( g_strDirs[g_numDirs], path, sizeof( g_strDirs[g_numDirs] ) );
 	vfsFixDOSName( g_strDirs[g_numDirs] );
-	vfsAddSlash( g_strDirs[g_numDirs] );
+	vfsAddSlash( g_strDirs[g_numDirs], sizeof( g_strDirs[g_numDirs] ) );
 	g_numDirs++;
 
 	if ( g_bUsePak ) {
@@ -470,7 +470,7 @@ void vfsInitDirectory( const char *path ){
 					break;
 				}
 
-				sprintf( filename, "%s/%s", path, name );
+				snprintf( filename, sizeof( filename ), "%s/%s", path, name );
 				vfsInitPakFile( filename );
 
 				g_free( name );
@@ -532,7 +532,7 @@ int vfsGetFileCount( const char *filename, int flag ){
 	char fixed[NAME_MAX], tmp[NAME_MAX];
 	GSList *lst;
 
-	strcpy( fixed, filename );
+	Q_strncpyz( fixed, filename, sizeof( fixed ) );
 	vfsFixDOSName( fixed );
 	strlwr( fixed );
 
@@ -550,8 +550,8 @@ int vfsGetFileCount( const char *filename, int flag ){
 	if ( !flag || ( flag & VFS_SEARCH_DIR ) ) {
 		for ( i = 0; i < g_numDirs; i++ )
 		{
-			strcpy( tmp, g_strDirs[i] );
+			Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-			strcat( tmp, fixed );
+			strncat( tmp, fixed, sizeof( tmp ) );
 			if ( access( tmp, R_OK ) == 0 ) {
 				count++;
 			}
@@ -596,14 +596,14 @@ int vfsLoadFile( const char *filename, void **bufferptr, int index ){
 	GSList *lst;
 
 	*bufferptr = NULL;
-	strcpy( fixed, filename );
+	Q_strncpyz( fixed, filename, sizeof( fixed ) );
 	vfsFixDOSName( fixed );
 	strlwr( fixed );
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( tmp, g_strDirs[i] );
+		Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-		strcat( tmp, filename );
+		strncat( tmp, filename, sizeof( tmp ) );
 		if ( access( tmp, R_OK ) == 0 ) {
 			if ( count == index ) {
 				return vfsLoadFullPathFile( tmp,bufferptr );
@@ -682,11 +682,11 @@ char* vfsExtractRelativePath_short( const char *in, bool shorten ){
 	}
 	else
 	{
-		strcpy( l_in,in );
+		Q_strncpyz( l_in, in, sizeof( l_in ) );
 	}
 	vfsCleanFileName( l_in );
 #else
-	strcpy( l_in, in );
+	Q_strncpyz( l_in, in, sizeof( l_in ) );
 	vfsCleanFileName( l_in );
 #endif // ifdef WIN32
 
@@ -697,7 +697,7 @@ char* vfsExtractRelativePath_short( const char *in, bool shorten ){
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( check,g_strDirs[i] );
+		Q_strncpyz( check, g_strDirs[i], sizeof( check ) );
 		vfsCleanFileName( check );
 #ifdef DBG_RLTPATH
 		Sys_Printf( "Matching against %s\n", check );
@@ -705,7 +705,7 @@ char* vfsExtractRelativePath_short( const char *in, bool shorten ){
 
 		// try to find a match
 		if ( strstr( l_in, check ) ) {
-			strcpy( out,l_in + strlen( check ) + 1 );
+			Q_strncpyz( out, l_in + strlen( check ) + 1, sizeof( out ) );
 			break;
 		}
 
@@ -745,7 +745,7 @@ char* vfsExtractRelativePath( const char *in ){
 				}
 			}
 			// this is the clean, not short version
-			strcpy( out, in );
+			Q_strncpyz( out, in, sizeof( out ) );
 			vfsCleanFileName( out );
 			for ( i = 0; i <= count; i++ )
 			{
@@ -786,7 +786,7 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 		char fixed[NAME_MAX];
 		GSList *lst;
 
-		strcpy( fixed, in );
+		Q_strncpyz( fixed, in, sizeof( fixed ) );
 		vfsFixDOSName( fixed );
 		strlwr( fixed );
 
@@ -801,7 +801,7 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 				lastptr = ptr + 1;
 
 			if ( strcmp( lastptr, fixed ) == 0 ) {
-				strncpy( out,file->name,PATH_MAX );
+				Q_strncpyz( out, file->name, sizeof( out ) );
 				return out;
 			}
 		}
@@ -811,11 +811,11 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 	if ( !flag || ( flag & VFS_SEARCH_DIR ) ) {
 		for ( i = 0; i < g_numDirs; i++ )
 		{
-			strcpy( tmp, g_strDirs[i] );
+			Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-			strcat( tmp, in );
+			strncat( tmp, in, sizeof( tmp ) );
 			if ( access( tmp, R_OK ) == 0 ) {
 				if ( count == index ) {
-					strcpy( out, tmp );
+					Q_strncpyz( out, tmp, sizeof( out ) );
 					return out;
 				}
 				count++;

plugins/vfswad/vfs.cpp

@@ -85,11 +85,11 @@ static int g_numDirs;
 // =============================================================================
 // Static functions
 
-static void vfsAddSlash( char *str ){
+static void vfsAddSlash( char *str, size_t length ){
 	int n = strlen( str );
 	if ( n > 0 ) {
 		if ( str[n - 1] != '\\' && str[n - 1] != '/' ) {
-			strcat( str, "/" );
+			strncat( str, "/", length );
 		}
 	}
 }
@@ -116,7 +116,7 @@ int vfsBuildShortPathName( const char* pPath, char* pBuffer, int nBufferLen ){
 	int nResult = GetFullPathName( pPath, nBufferLen, pBuffer, &pFile );
 	nResult = GetShortPathName( pPath, pBuffer, nBufferLen );
 	if ( nResult == 0 ) {
-		strcpy( pBuffer, pPath );               // Use long filename
+		Q_strncpyz( pBuffer, pPath, nBufferLen );               // Use long filename
 	}
 	return nResult;
 #endif
@@ -162,7 +162,7 @@ static void vfsInitPakFile( const char *filename ){
 	for ( i = strlen( filename ) - 1 ; i >= 0 && filename[i] != '\\' && filename[i] != '/' ; i-- )
 		wadnameptr = (char *)filename + i;
 
-	strcpy( wadname,wadnameptr );
+	Q_strncpyz( wadname, wadnameptr, sizeof( wadname ) );
 	wadname[strlen( wadname ) - 4] = 0; // ditch the .wad so everthing looks nice!
 	strlwr( wadname );
 
@@ -190,10 +190,10 @@ static void vfsInitPakFile( const char *filename ){
 
 		// texturenames in wad files don't have an extensions or paths, so we must add them!
 		if ( wf->lpLump->type == WAD2_TYPE_MIP ) {
-			sprintf( filename_inwadfixed,"textures/%s/%s.mip",wadname,filename_inwad );
+			snprintf( filename_inwadfixed, sizeof( filename_inwadfixed ), "textures/%s/%s.mip", wadname,filename_inwad );
 		}
 		else {
-			sprintf( filename_inwadfixed,"textures/%s/%s.hlw",wadname,filename_inwad );
+			snprintf( filename_inwadfixed, sizeof( filename_inwadfixed ), "textures/%s/%s.hlw", wadname,filename_inwad );
 		}
 
 		//g_FuncTable.m_pfnSysFPrintf(SYS_WRN, "  scanned %s\\%s\n", filename,filename_inwad);
@@ -221,10 +221,10 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 	int i;
 
 	if ( refdir != NULL ) {
-		strcpy( dirname, refdir );
+		Q_strncpyz( dirname, refdir, sizeof( dirname ) );
 		strlwr( dirname );
 		vfsFixDOSName( dirname );
-		vfsAddSlash( dirname );
+		vfsAddSlash( dirname, sizeof( dirname ) );
 	}
 	else{
 		dirname[0] = '\0';
@@ -232,7 +232,7 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 	dirlen = strlen( dirname );
 
 	if ( ext != NULL ) {
-		strcpy( extension, ext );
+		Q_strncpyz( extension, ext, sizeof( extension ) );
 	}
 	else{
 		extension[0] = '\0';
@@ -299,8 +299,8 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( basedir, g_strDirs[i] );
+		Q_strncpyz( basedir, g_strDirs[i], sizeof( basedir ) );
-		strcat( basedir, dirname );
+		strncat( basedir, dirname, sizeof( basedir ) );
 
 		GDir* dir = g_dir_open( basedir, 0, NULL );
 
@@ -316,7 +316,7 @@ static GSList* vfsGetListInternal( const char *refdir, const char *ext, bool dir
 					continue;
 				}
 
-				sprintf( filename, "%s%s", basedir, name );
+				snprintf( filename, sizeof( filename ), "%s%s", basedir, name );
 				stat( filename, &st );
 
 				if ( ( S_ISDIR( st.st_mode ) != 0 ) != directories ) {
@@ -366,9 +366,9 @@ void vfsInitDirectory( const char *path ){
 		return;
 	}
 
-	strcpy( g_strDirs[g_numDirs], path );
+	Q_strncpyz( g_strDirs[g_numDirs], path, sizeof( g_strDirs[g_numDirs] ) );
 	vfsFixDOSName( g_strDirs[g_numDirs] );
-	vfsAddSlash( g_strDirs[g_numDirs] );
+	vfsAddSlash( g_strDirs[g_numDirs], sizeof( g_strDirs[g_numDirs] ) );
 	g_numDirs++;
 
 //  if (g_PrefsDlg.m_bPAK)
@@ -389,7 +389,7 @@ void vfsInitDirectory( const char *path ){
 					continue;
 				}
 
-				sprintf( filename, "%s/%s", path, name );
+				snprintf( filename, sizeof( filename ), "%s/%s", path, name );
 				vfsInitPakFile( filename );
 			}
 			g_dir_close( dir );
@@ -450,7 +450,7 @@ int vfsGetFileCount( const char *filename, int flag ){
 	char fixed[NAME_MAX], tmp[NAME_MAX];
 	GSList *lst;
 
-	strcpy( fixed, filename );
+	Q_strncpyz( fixed, filename, sizeof( fixed ) );
 	vfsFixDOSName( fixed );
 	strlwr( fixed );
 
@@ -468,8 +468,8 @@ int vfsGetFileCount( const char *filename, int flag ){
 	if ( !flag || ( flag & VFS_SEARCH_DIR ) ) {
 		for ( i = 0; i < g_numDirs; i++ )
 		{
-			strcpy( tmp, g_strDirs[i] );
+			Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-			strcat( tmp, fixed );
+			strncat( tmp, fixed, sizeof( tmp ) );
 			if ( access( tmp, R_OK ) == 0 ) {
 				count++;
 			}
@@ -514,14 +514,14 @@ int vfsLoadFile( const char *filename, void **bufferptr, int index ){
 	GSList *lst;
 
 	*bufferptr = NULL;
-	strcpy( fixed, filename );
+	Q_strncpyz( fixed, filename, sizeof( fixed ) );
 	vfsFixDOSName( fixed );
 	strlwr( fixed );
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( tmp, g_strDirs[i] );
+		Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-		strcat( tmp, filename );
+		strncat( tmp, filename, sizeof( tmp ) );
 		if ( access( tmp, R_OK ) == 0 ) {
 			if ( count == index ) {
 				return vfsLoadFullPathFile( tmp,bufferptr );
@@ -633,8 +633,8 @@ char* vfsExtractRelativePath( const char *in ){
 	Sys_Printf( "vfsExtractRelativePath: %s\n", in );
 #endif
 
-	strcpy( l_in,in );
+	Q_strncpyz( l_in, in, sizeof( l_in ) );
-	vfsCleanFileName( l_in );
+	vfsCleanFileName( l_in, sizeof( l_in ) );
 
 #ifdef DBG_RLTPATH
 	Sys_Printf( "cleaned path: %s\n", l_in );
@@ -642,15 +642,15 @@ char* vfsExtractRelativePath( const char *in ){
 
 	for ( i = 0; i < g_numDirs; i++ )
 	{
-		strcpy( check,g_strDirs[i] );
+		Q_strncpyz( check, g_strDirs[i], sizeof( check ) );
-		vfsCleanFileName( check );
+		vfsCleanFileName( check, sizeof( check ) );
 #ifdef DBG_RLTPATH
 		Sys_Printf( "Matching against %s\n", check );
 #endif
 
 		// try to find a match
 		if ( strstr( l_in, check ) ) {
-			strcpy( out,l_in + strlen( check ) + 1 );
+			Q_strncpyz( out, l_in + strlen( check ) + 1, sizeof( out ) );
 			break;
 		}
 	}
@@ -667,7 +667,7 @@ char* vfsExtractRelativePath( const char *in ){
 }
 
 // removed CString usage
-void vfsCleanFileName( char *in ){
+void vfsCleanFileName( char *in, size_t length ){
 	char str[PATH_MAX];
 	vfsBuildShortPathName( in, str, PATH_MAX );
 	strlwr( str );
@@ -676,7 +676,7 @@ void vfsCleanFileName( char *in ){
 	if ( str[n - 1] == '/' ) {
 		str[n - 1] = '\0';
 	}
-	strcpy( in, str );
+	Q_strncpyz( in, str, length );
 }
 
 // HYDRA: this now searches VFS/PAK files in addition to the filesystem
@@ -694,7 +694,7 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 		char fixed[NAME_MAX];
 		GSList *lst;
 
-		strcpy( fixed, in );
+		Q_strncpyz( fixed, in, sizeof( fixed ) );
 		vfsFixDOSName( fixed );
 		strlwr( fixed );
 
@@ -709,7 +709,7 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 				lastptr = ptr + 1;
 
 			if ( strcmp( lastptr, fixed ) == 0 ) {
-				strncpy( out,file->name,PATH_MAX );
+				Q_strncpyz( out, file->name, sizeof( out ) );
 				return out;
 			}
 		}
@@ -719,11 +719,11 @@ char* vfsGetFullPath( const char *in, int index, int flag ){
 	if ( !flag || ( flag & VFS_SEARCH_DIR ) ) {
 		for ( i = 0; i < g_numDirs; i++ )
 		{
-			strcpy( tmp, g_strDirs[i] );
+			Q_strncpyz( tmp, g_strDirs[i], sizeof( tmp ) );
-			strcat( tmp, in );
+			strncat( tmp, in, sizeof( tmp ) );
 			if ( access( tmp, R_OK ) == 0 ) {
 				if ( count == index ) {
-					strcpy( out, tmp );
+					Q_strncpyz( out, tmp, sizeof( out ) );
 					return out;
 				}
 				count++;

plugins/vfswad/vfs.h

@@ -51,7 +51,7 @@ int vfsLoadFullPathFile( const char *filename, void **buffer );
 // on win32, will build the short path name
 // directories will be cleaned, no ending filename seperator
 // we modify the entry directly, the size of the string can only go down
-void vfsCleanFileName( char * );
+void vfsCleanFileName( char *, size_t );
 // these return a static char*, doesn't need to be freed or anything
 // get the base path to use when raising file dialogs
 // we manually add "maps/" or "sounds/" or "mapobjects/models/" etc.

radiant/brush.cpp

@@ -37,7 +37,7 @@ const char* Brush_Name( brush_t *b ){
 	static char cBuff[1024];
 	b->numberId = g_nBrushId++;
 	if ( g_qeglobals.m_bBrushPrimitMode ) {
-		sprintf( cBuff, "Brush %i", b->numberId );
+		snprintf( cBuff, sizeof( cBuff ), "Brush %i", b->numberId );
 		Brush_SetEpair( b, "Name", cBuff );
 	}
 	return cBuff;
@@ -1536,13 +1536,13 @@ const char* Brush_GetKeyValue( brush_t *b, const char *pKey ){
    temporary stuff, detect potential problems when saving the texture name
    =================
  */
-void CheckName( face_t *fa, char *pname ){
+void CheckName( face_t *fa, char *pname, size_t length ){
 	if ( !strlen( fa->texdef.GetName() ) ) {
 #ifdef _DEBUG
 		Sys_FPrintf( SYS_WRN, "WARNING: unexpected texdef.name is empty in Brush.cpp CheckName\n" );
 #endif
 		fa->texdef.SetName( SHADER_NOT_FOUND );
-		strcpy( pname, SHADER_NOT_FOUND );
+		Q_strncpyz( pname, SHADER_NOT_FOUND, length );
 		return;
 	}
 
@@ -1550,11 +1550,11 @@ void CheckName( face_t *fa, char *pname ){
 	if ( strchr( fa->texdef.GetName(), ' ' ) ) {
 		char Msg1[1024];
 
-		sprintf( Msg1, "Can't save texture with spaces in name. Rename %s\nNOTE: This message may popup several times .. once for each buggy face detected.", fa->texdef.GetName() );
+		snprintf( Msg1, sizeof( Msg1 ), "Can't save texture with spaces in name. Rename %s\nNOTE: This message may popup several times .. once for each buggy face detected.", fa->texdef.GetName() );
 
 		Sys_Printf( "%s\n", Msg1 );
 		gtk_MessageBox( g_pParentWnd->m_pWidget, Msg1, "Error saving map", MB_OK );
-		strcpy( pname, SHADER_NOT_FOUND );
+		Q_strncpyz( pname, SHADER_NOT_FOUND, length );
 		return;
 	}
 
@@ -1566,10 +1566,10 @@ void CheckName( face_t *fa, char *pname ){
 		gtk_MessageBox( g_pParentWnd->m_pWidget, text, "Error saving map", MB_OK );
 		// need to cleanup this dead face name or we may loop endlessly
 		fa->texdef.SetName( SHADER_NOT_FOUND );
-		strcpy( pname, SHADER_NOT_FOUND );
+		Q_strncpyz( pname, SHADER_NOT_FOUND, length );
 		return;
 	}
-	strcpy( pname, fa->texdef.GetName() + 9 ); // remove "textures/"
+	Q_strncpyz( pname, fa->texdef.GetName() + 9, length ); // remove "textures/"
 }
 
 /*
@@ -3401,7 +3401,7 @@ void Brush_Move( brush_t *b, const vec3_t move, bool bSnap ){
 	if ( b->owner->eclass->fixedsize ) {
 		char text[64];
 		VectorAdd( b->owner->origin, move, b->owner->origin );
-		sprintf( text, "%i %i %i",
+		snprintf( text, sizeof( text ), "%i %i %i",
 				 (int)b->owner->origin[0], (int)b->owner->origin[1], (int)b->owner->origin[2] );
 		SetKeyValue( b->owner, "origin", text );
 		//VectorAdd(b->maxs, b->mins, b->owner->origin);

radiant/dialog.cpp

@@ -119,7 +119,7 @@ void Dialog::AddModalButton( GtkWidget *widget, int ret ) {
 void Dialog::UpdateData( bool retrieve ){
 	DLG_DATA *data;
 	GSList *lst;
-	char buf[32];
+	char buf[64];
 
 	if ( retrieve ) {
 		for ( lst = m_pDataList; lst != NULL; lst = g_slist_next( lst ) )
@@ -221,11 +221,11 @@ void Dialog::UpdateData( bool retrieve ){
 				gtk_entry_set_text( GTK_ENTRY( data->object ), txt );
 			} break;
 			case DLG_ENTRY_FLOAT:
-				sprintf( buf, "%g", ( *(float*)data->buffer ) );
+				snprintf( buf, sizeof( buf ), "%g", ( *(float*)data->buffer ) );
 				gtk_entry_set_text( GTK_ENTRY( data->object ), buf );
 				break;
 			case DLG_ENTRY_INT:
-				sprintf( buf, "%d", ( *(int*)data->buffer ) );
+				snprintf( buf, sizeof( buf ), "%d", ( *(int*)data->buffer ) );
 				gtk_entry_set_text( GTK_ENTRY( data->object ), buf );
 				break;
 			case DLG_SPIN_FLOAT:

radiant/drag.cpp

@@ -282,14 +282,14 @@ void UpdateTarget( vec3_t origin, vec3_t dir ){
 		i = IntForKey( pe, "target" );
 		if ( i <= 0 ) {
 			i = GetUniqueTargetId( 1 );
-			sprintf( sz, "%d", i );
+			snprintf( sz, sizeof( sz ), "%d", i );
 
 			SetKeyValue( pe, "target", sz );
 		}
 
 		// set the target # into our src
 
-		sprintf( sz, "%d", i );
+		snprintf( sz, sizeof( sz ), "%d", i );
 		SetKeyValue( peLink, "targetname", sz );
 
 		Sys_UpdateWindows( W_ENTITY );

radiant/eclass.cpp

@@ -227,7 +227,7 @@ void Eclass_CreateSpriteModelPaths(){
 			{
 
 				// strip the path/ and the .extension.
-				ExtractFileBase( (char *)pFile->data,filename );
+				ExtractFileBase( (char *)pFile->data, filename, sizeof( filename ) );
 
 				// does the eclass name match the filename?
 				if ( stricmp( e->name,filename ) == 0 ) {
@@ -269,7 +269,7 @@ void EClass_InitForFileList( GSList *pFiles, _EClassTable *pTable ){
 		// this allows to override baseq3/scripts/entities.def for instance
 		char relPath[PATH_MAX];
 		strcpy( relPath, "scripts/" );
-		strcat( relPath, (char*)pFile->data );
+		strncat( relPath, (char*)pFile->data, sizeof( relPath ) );
 		if ( !vfsGetFullPath( relPath, 0, 0 ) ) {
 			Sys_FPrintf( SYS_ERR, "Failed to find the full path for '%s' in the VFS\n", relPath );
 		}
@@ -286,7 +286,7 @@ void EClass_InitForFileList( GSList *pFiles, _EClassTable *pTable ){
  */
 eclass_t * EClass_Create( const char *name, float col1, float col2, float col3, const vec3_t *mins, const vec3_t *maxs, const char *comments ){
 	eclass_t *e;
-	char color[128];
+	char color[256];
 
 	e = (eclass_t*)malloc( sizeof( *e ) );
 	memset( e, 0, sizeof( *e ) );
@@ -297,7 +297,7 @@ eclass_t * EClass_Create( const char *name, float col1, float col2, float col3,
 	e->color[0] = col1;
 	e->color[1] = col2;
 	e->color[2] = col3;
-	sprintf( color, "(%f %f %f)", e->color[0], e->color[1], e->color[2] );
+	snprintf( color, sizeof( color ), "(%f %f %f)", e->color[0], e->color[1], e->color[2] );
 	e->texdef.SetName( color );
 
 	// supplied size ?
@@ -404,7 +404,7 @@ void Eclass_Init(){
 				// this allows to override baseq3/scripts/entities.def for instance
 				char relPath[PATH_MAX];
 				strcpy( relPath, "scripts/" );
-				strcat( relPath, (char*)pFile->data );
+				strncat( relPath, (char*)pFile->data, sizeof( relPath ) );
 				char *fullpath = vfsGetFullPath( relPath, 0, 0 );
 				if ( !fullpath ) {
 					Sys_FPrintf( SYS_ERR, "Failed to find the full path for \"%s\" in the VFS\n", relPath );

radiant/eclass_def.cpp

@@ -113,8 +113,7 @@ void setSpecialLoad( eclass_t *e, const char* pWhat, char*& p ){
 	if ( where ) {
 		int len = ( where - pText );
 		p = new char[len + 1];
-		strncpy( p,pText,len );
+		Q_strncpyz( p, pText, len + 1 );
-		p[len] = 0; // just to make sure, as most implementations of strncpy don't null terminate
 	}
 	else{
 		p = strdup( pText );
@@ -129,7 +128,7 @@ eclass_t *Eclass_InitFromText( char *text ){
 	int r, i;
 	char parms[256], *p;
 	eclass_t    *e;
-	char color[128];
+	char color[256];
 
 	e = (eclass_t*)malloc( sizeof( *e ) );
 	memset( e, 0, sizeof( *e ) );
@@ -147,7 +146,7 @@ eclass_t *Eclass_InitFromText( char *text ){
 	if ( r != 3 ) {
 		return e;
 	}
-	sprintf( color, "(%f %f %f)", e->color[0], e->color[1], e->color[2] );
+	snprintf( color, sizeof( color ), "(%f %f %f)", e->color[0], e->color[1], e->color[2] );
 	//strcpy (e->texdef.name, color);
 	e->texdef.SetName( color );
 
@@ -204,7 +203,12 @@ eclass_t *Eclass_InitFromText( char *text ){
 		if ( !p ) {
 			break;
 		}
-		strcpy( e->flagnames[i], Get_COM_Token() );
+		Q_strncpyz( e->flagnames[i], Get_COM_Token(), sizeof( e->flagnames[i] ) );
+
+		if( strlen( Get_COM_Token() ) > sizeof( e->flagnames[i] ) - 1 )
+		{
+			Syn_Printf( "Warning: spawnflag/parm/flagname too long for Eclass %s: %s\n", e->name, e->flagnames[i] );
+		}
 	}
 
 	// find the length until close comment

radiant/error.cpp

@@ -45,16 +45,16 @@ void Error( const char *error, ... ){
 	char text[4096];
 
 	va_start( argptr,error );
-	vsprintf( text, error,argptr );
+	vsnprintf( text, sizeof( text ), error, argptr );
 	va_end( argptr );
 
-	strcat( text, "\n" );
+	strncat( text, "\n", sizeof( text ) );
 
 #if defined ( __linux__ ) || defined ( __APPLE__ )
 	if ( errno != 0 ) {
-		strcat( text, "errno: " );
+		strncat( text, "errno: ", sizeof( text ) );
-		strcat( text, strerror( errno ) );
+		strncat( text, strerror( errno ), sizeof( text ) );
-		strcat( text, "\n" );
+		strncat( text, "\n", sizeof( text ) );
 	}
 #endif
 
@@ -72,7 +72,7 @@ void Error( const char *error, ... ){
 			0,
 			NULL
 			);
-		strcat( text, "GetLastError: " );
+		strncat( text, "GetLastError: ", sizeof( text ) );
 		/*
 		   Gtk will only crunch 0<=char<=127
 		   this is a bit hackish, but I didn't find useful functions in win32 API for this
@@ -90,7 +90,7 @@ void Error( const char *error, ... ){
 			}
 			next = CharNext( scan );
 		} while ( next != scan );
-		strcat( text, "\n" );
+		strncat( text, "\n", sizeof( text ) );
 		LocalFree( lpMsgBuf );
 	}
 #endif
@@ -103,14 +103,14 @@ void Error( const char *error, ... ){
 		GLenum iGLError = qglGetError();
 		if ( iGLError != GL_NO_ERROR ) {
 			// use our own gluErrorString
-			strcat( text, "qgluErrorString: " );
+			strncat( text, "qgluErrorString: ", sizeof( text ) );
-			strcat( text, (char*)qgluErrorString( iGLError ) );
+			strncat( text, (char*)qgluErrorString( iGLError ), sizeof( text ) );
-			strcat( text, "\n" );
+			strncat( text, "\n", sizeof( text ) );
 		}
 	}
 
-	strcat( text, "An unrecoverable error has occured.\n"
+	strncat( text, "An unrecoverable error has occured.\n"
-				  "Would you like to edit Preferences before exiting Radiant?" );
+				  "Would you like to edit Preferences before exiting Radiant?", sizeof( text ) );
 
 	Sys_Printf( text );
 
@@ -138,7 +138,7 @@ void WINAPI Error( char *error, ... ){
 	char text[1024];
 
 	va_start( argptr,error );
-	vsprintf( text, error,argptr );
+	vsnprintf( text, sizeof( text ), error, argptr );
 	va_end( argptr );
 
 	Error( (const char *)text );

radiant/file.cpp

@@ -229,7 +229,7 @@ void MemStream::printf( const char* s, ... ){
 
 	char buffer[4096];
 	va_start( args, s );
-	vsprintf( buffer, s, args );
+	vsnprintf( buffer, sizeof( buffer ), s, args );
 	va_end( args );
 	Write( buffer, strlen( buffer ) );
 }

radiant/groupdialog.cpp

@@ -194,7 +194,7 @@ void GetSpawnFlags( void ){
 	}
 	else
 	{
-		sprintf( sz, "%i", f );
+		snprintf( sz, sizeof( sz ), "%i", f );
 		if ( multiple_entities ) {
 			brush_t   *b;
 
@@ -564,13 +564,13 @@ bool GetSelectAllCriteria( CString &strKey, CString &strVal ){
 void AssignSound(){
 	char buffer[NAME_MAX];
 
-	strcpy( buffer, g_qeglobals.m_strHomeMaps.GetBuffer() );
+	Q_strncpyz( buffer, g_qeglobals.m_strHomeMaps.GetBuffer(), sizeof( buffer ) );
-	strcat( buffer, "sound/" );
+	strncat( buffer, "sound/", sizeof( buffer ) );
 
 	if ( access( buffer, R_OK ) != 0 ) {
 		// just go to fsmain
-		strcpy( buffer, g_qeglobals.m_strHomeMaps.GetBuffer() );
+		Q_strncpyz( buffer, g_qeglobals.m_strHomeMaps.GetBuffer(), sizeof( buffer ) );
-		strcat( buffer, "/" );
+		strncat( buffer, "/", sizeof( buffer ) );
 	}
 
 	const char *filename = file_dialog( g_pGroupDlg->m_pWidget, TRUE, _( "Open Wav File" ), buffer, "sound" );
@@ -595,13 +595,13 @@ void AssignSound(){
 void AssignModel(){
 	char buffer[NAME_MAX];
 
-	strcpy( buffer, g_qeglobals.m_strHomeMaps.GetBuffer() );
+	Q_strncpyz( buffer, g_qeglobals.m_strHomeMaps.GetBuffer(), sizeof( buffer ) );
-	strcat( buffer, "models/" );
+	strncat( buffer, "models/", sizeof( buffer ) );
 
 	if ( access( buffer, R_OK ) != 0 ) {
 		// just go to fsmain
-		strcpy( buffer, g_qeglobals.m_strHomeMaps.GetBuffer() );
+		Q_strncpyz( buffer, g_qeglobals.m_strHomeMaps.GetBuffer(), sizeof( buffer ) );
-		strcat( buffer, "/" );
+		strncat( buffer, "/", sizeof( buffer ) );
 	}
 
 	const char *filename = file_dialog( g_pGroupDlg->m_pWidget, TRUE, _( "Open Model" ), buffer, MODEL_MAJOR );

radiant/gtkdlgs.cpp

@@ -1393,7 +1393,7 @@ void DoMapInfo(){
 	{
 		entry = (map_t*)entitymap->data;
 		char tmp[16];
-		sprintf( tmp, "%d", entry->count );
+		snprintf( tmp, sizeof( tmp ), "%d", entry->count );
 		GtkTreeIter iter;
 		gtk_list_store_append( GTK_LIST_STORE( store ), &iter );
 		gtk_list_store_set( GTK_LIST_STORE( store ), &iter, 0, entry->name, 1, tmp, -1 );
@@ -1404,11 +1404,11 @@ void DoMapInfo(){
 	g_object_unref( G_OBJECT( store ) );
 
 	char tmp[16];
-	sprintf( tmp, "%d", TotalBrushes );
+	snprintf( tmp, sizeof( tmp ), "%d", TotalBrushes );
 	gtk_entry_set_text( GTK_ENTRY( brushes_entry ), tmp );
-	sprintf( tmp, "%d", TotalEntities );
+	snprintf( tmp, sizeof( tmp ), "%d", TotalEntities );
 	gtk_entry_set_text( GTK_ENTRY( entities_entry ), tmp );
-	sprintf( tmp, "%d", Net );
+	snprintf( tmp, sizeof( tmp ), "%d", Net );
 	gtk_entry_set_text( GTK_ENTRY( net_entry ), tmp );
 
 	gtk_grab_add( dlg );
@@ -3264,8 +3264,8 @@ int DoBSInputDlg( const char *fields[5], float values[5] ){
 		gtk_widget_show( entries[i] );
 		gtk_box_pack_start( GTK_BOX( vbox ), entries[i], TRUE, TRUE, 0 );
 
-		char buf[32];
+		char buf[64];
-		sprintf( buf, "%f", values[i] );
+		snprintf( buf, sizeof( buf ), "%f", values[i] );
 		gtk_entry_set_text( GTK_ENTRY( entries[i] ), buf );
 	}
 

radiant/gtkmisc.cpp

@@ -1493,11 +1493,11 @@ const char* file_dialog( void *parent, gboolean open, const char* title, const c
 
 	// we expect an actual path below, if the path is NULL we might crash
 	if ( !path || path[0] == '\0' ) {
-		strcpy( buf, g_pGameDescription->mEnginePath.GetBuffer() );
+		Q_strncpyz( buf, g_pGameDescription->mEnginePath.GetBuffer(), sizeof( buf ) );
-		strcat( buf, g_pGameDescription->mBaseGame.GetBuffer() );
+		strncat( buf, g_pGameDescription->mBaseGame.GetBuffer(), sizeof( buf ) );
-		strcat( buf, "/" );
+		strncat( buf, "/", sizeof( buf ) );
 		if ( baseSubDir ) {
-			strcat( buf, baseSubDir );
+			strncat( buf, baseSubDir, sizeof( buf ) );
 		}
 		path = buf;
 	}
@@ -1547,7 +1547,9 @@ const char* file_dialog( void *parent, gboolean open, const char* title, const c
 	}
 
 	if ( gtk_dialog_run( GTK_DIALOG( file_sel ) ) == GTK_RESPONSE_ACCEPT ) {
-		strcpy( szFile, gtk_file_chooser_get_filename( GTK_FILE_CHOOSER( file_sel ) ) );
+		gchar * filename = gtk_file_chooser_get_filename( GTK_FILE_CHOOSER( file_sel ) );
+		Q_strncpyz( szFile, filename, sizeof( szFile ) );
+		g_free( filename );
 	}
 	else {
 		szFile[0] = '\0';

radiant/main.cpp

@@ -182,11 +182,11 @@ int loki_getmountpoint( const char *device, char *mntpt, int max_size ){
 		{
 			char *tmp, mntdev[1024];
 
-			strcpy( mntdev, mntent->mnt_fsname );
+			Q_strncpyz( mntdev, mntent->mnt_fsname, sizeof( mntdev ) );
 			if ( strcmp( mntent->mnt_type, "supermount" ) == 0 ) {
 				tmp = strstr( mntent->mnt_opts, "dev=" );
 				if ( tmp ) {
-					strcpy( mntdev, tmp + strlen( "dev=" ) );
+					Q_strcnpyz( mntdev, tmp + strlen( "dev=" ), sizeof( mntdev ) );
 					tmp = strchr( mntdev, ',' );
 					if ( tmp ) {
 						*tmp = '\0';
@@ -310,61 +310,61 @@ void error_redirect( const gchar *domain, GLogLevelFlags log_level, const gchar
 	}
 
 	if ( domain ) {
-		strcpy( buf, domain );
+		Q_strncpyz( buf, domain, sizeof( buf ) );
 	}
 	else{
-		strcpy( buf, "**" );
+		Q_strncpyz( buf, "**", sizeof( buf ) );
 	}
-	strcat( buf, "-" );
+	strncat( buf, "-", sizeof( buf ) );
 
 	switch ( log_level )
 	{
 	case G_LOG_LEVEL_ERROR:
 		if ( in_recursion ) {
-			strcat( buf, "ERROR (recursed) **: " );
+			strncat( buf, "ERROR (recursed) **: ", sizeof( buf ) );
 		}
 		else{
-			strcat( buf, "ERROR **: " );
+			strncat( buf, "ERROR **: ", sizeof( buf ) );
 		}
 		break;
 	case G_LOG_LEVEL_CRITICAL:
 		if ( in_recursion ) {
-			strcat( buf, "CRITICAL (recursed) **: " );
+			strncat( buf, "CRITICAL (recursed) **: ", sizeof( buf ) );
 		}
 		else{
-			strcat( buf, "CRITICAL **: " );
+			strncat( buf, "CRITICAL **: ", sizeof( buf ) );
 		}
 		break;
 	case G_LOG_LEVEL_WARNING:
 		if ( in_recursion ) {
-			strcat( buf, "WARNING (recursed) **: " );
+			strncat( buf, "WARNING (recursed) **: ", sizeof( buf ) );
 		}
 		else{
-			strcat( buf, "WARNING **: " );
+			strncat( buf, "WARNING **: ", sizeof( buf ) );
 		}
 		break;
 	case G_LOG_LEVEL_MESSAGE:
 		if ( in_recursion ) {
-			strcat( buf, "Message (recursed): " );
+			strncat( buf, "Message (recursed): ", sizeof( buf ) );
 		}
 		else{
-			strcat( buf, "Message: " );
+			strncat( buf, "Message: ", sizeof( buf ) );
 		}
 		break;
 	case G_LOG_LEVEL_INFO:
 		if ( in_recursion ) {
-			strcat( buf, "INFO (recursed): " );
+			strncat( buf, "INFO (recursed): ", sizeof( buf ) );
 		}
 		else{
-			strcat( buf, "INFO: " );
+			strncat( buf, "INFO: ", sizeof( buf ) );
 		}
 		break;
 	case G_LOG_LEVEL_DEBUG:
 		if ( in_recursion ) {
-			strcat( buf, "DEBUG (recursed): " );
+			strncat( buf, "DEBUG (recursed): ", sizeof( buf ) );
 		}
 		else{
-			strcat( buf, "DEBUG: " );
+			strncat( buf, "DEBUG: ", sizeof( buf ) );
 		}
 		break;
 	default:
@@ -372,10 +372,10 @@ void error_redirect( const gchar *domain, GLogLevelFlags log_level, const gchar
 		 * try to make the best out of it.
 		 */
 		if ( in_recursion ) {
-			strcat( buf, "LOG (recursed:" );
+			strncat( buf, "LOG (recursed:", sizeof( buf ) );
 		}
 		else{
-			strcat( buf, "LOG (" );
+			strncat( buf, "LOG (", sizeof( buf ) );
 		}
 		if ( log_level ) {
 			gchar string[] = "0x00): ";
@@ -390,19 +390,19 @@ void error_redirect( const gchar *domain, GLogLevelFlags log_level, const gchar
 				*p += 'A' - '9' - 1;
 			}
 
-			strcat( buf, string );
+			strncat( buf, string, sizeof( buf ) );
 		}
 		else{
-			strcat( buf, "): " );
+			strncat( buf, "): ", sizeof( buf ) );
 		}
 	}
 
-	strcat( buf, message );
+	strncat( buf, message, sizeof( buf ) );
 	if ( is_fatal ) {
-		strcat( buf, "\naborting...\n" );
+		strncat( buf, "\naborting...\n", sizeof( buf ) );
 	}
 	else{
-		strcat( buf, "\n" );
+		strncat( buf, "\n", sizeof( buf ) );
 	}
 
 	printf( "%s\n", buf );
@@ -777,7 +777,7 @@ int mainRadiant( int argc, char* argv[] ) {
 			// remove the game prefs files
 			remove( g_PrefsDlg.m_inipath->str );
 			char buf[PATH_MAX];
-			sprintf( buf, "%sSavedInfo.bin", g_PrefsDlg.m_rc_path->str );
+			snprintf( buf, sizeof( buf ), "%sSavedInfo.bin", g_PrefsDlg.m_rc_path->str );
 			remove( buf );
 			// remove the global pref too
 			g_PrefsDlg.mGamesDialog.Reset();
@@ -1004,12 +1004,12 @@ void QE_ExpandBspString( char *bspaction, GPtrArray *out_array, char *mapname ){
 	char rsh[BIG_PATH_MAX];
 	char base[BIG_PATH_MAX];
 
-	strcpy( src, mapname );
+	Q_strncpyz( src, mapname, sizeof( src ) );
 	strlwr( src );
 	in = strstr( src, "maps/" );
 	if ( in ) {
 		in += 5;
-		strcpy( base, in );
+		Q_strncpyz( base, in, sizeof( base ) );
 		out = base;
 		while ( *out )
 		{
@@ -1021,7 +1021,7 @@ void QE_ExpandBspString( char *bspaction, GPtrArray *out_array, char *mapname ){
 	}
 	else
 	{
-		ExtractFileName( mapname, base );
+		ExtractFileName( mapname, base, sizeof( base ) );
 	}
 
 	// this important step alters the map name to add fs_game
@@ -1036,11 +1036,11 @@ void QE_ExpandBspString( char *bspaction, GPtrArray *out_array, char *mapname ){
 	if ( g_pGameDescription->mGameFile != "hl.game" &&
 		 *ValueForKey( g_qeglobals.d_project_entity,"gamename" ) != '\0' ) {
 		// set with fs_game
-		sprintf( src, "-fs_game %s \"%s\"", ValueForKey( g_qeglobals.d_project_entity,"gamename" ), mapname );
+		snprintf( src, sizeof( src ), "-fs_game %s \"%s\"", ValueForKey( g_qeglobals.d_project_entity,"gamename" ), mapname );
 	}
 	else
 	{
-		sprintf( src, "\"%s\"", mapname );
+		snprintf( src, sizeof( src ), "\"%s\"", mapname );
 	}
 
 	rsh[0] = 0;
@@ -1049,14 +1049,14 @@ void QE_ExpandBspString( char *bspaction, GPtrArray *out_array, char *mapname ){
 
 	// initialise the first step
 	out = new char[BIG_PATH_MAX];
+	*out = 0;
 	g_ptr_array_add( out_array, out );
 
 	in = ValueForKey( g_qeglobals.d_project_entity, bspaction );
 	while ( *in )
 	{
 		if ( in[0] == '!' ) {
-			strcpy( out, rsh );
+			strncat( out, rsh, BIG_PATH_MAX );
-			out += strlen( rsh );
 			in++;
 			continue;
 		}
@@ -1066,36 +1066,39 @@ void QE_ExpandBspString( char *bspaction, GPtrArray *out_array, char *mapname ){
 			if ( g_PrefsDlg.m_bWatchBSP ) {
 				// -connect global option (the only global option so far anyway)
 				strcpy( tmp, " -connect 127.0.0.1:39000 " );
-				strcpy( out, tmp );
+				strncat( out, tmp, BIG_PATH_MAX );
-				out += strlen( tmp );
 			}
 			in++;
 			continue;
 		}
 		if ( in[0] == '$' ) {
 			// $ expansion
-			strcpy( out, src );
+			strncat( out, src, BIG_PATH_MAX );
-			out += strlen( src );
 			in++;
 			continue;
 		}
 		if ( in[0] == '@' ) {
-			*out++ = '"';
+			strncat( out, "\"", BIG_PATH_MAX );
 			in++;
 			continue;
 		}
 		if ( in[0] == '&' ) {
 			if ( in[1] == '&' ) {
 				// start a new step
-				*out = 0;
 				in = in + 2;
 				out = new char[BIG_PATH_MAX];
+				*out = 0;
 				g_ptr_array_add( out_array, out );
 			}
 		}
-		*out++ = *in++;
+		size_t len = strlen( out );
+		if( ( len + 1 ) < BIG_PATH_MAX )
+		{
+			out[len++] = *in;
+			out[len] = '\0';
+		}
+		in++;
 	}
-	*out = 0;
 }
 
 void FindReplace( CString& strContents, const char* pTag, const char* pValue ){
@@ -1114,15 +1117,15 @@ void FindReplace( CString& strContents, const char* pTag, const char* pValue ){
 }
 
 // save the map, deals with regioning
-void SaveWithRegion( char *name ){
+void SaveWithRegion( char *name, size_t length ){
-	strcpy( name, currentmap );
+	Q_strncpyz( name, currentmap, length );
 	if ( region_active ) {
 		// temporary cut the region to save regular map
 		region_active = false;
 		Map_SaveFile( name, false );
 		region_active = true;
 		StripExtension( name );
-		strcat( name, ".reg" );
+		strncat( name, ".reg", length );
 	}
 
 	Map_SaveFile( name, region_active );
@@ -1193,9 +1196,9 @@ void RunBsp( char *command ){
 
 	SetInspectorMode( W_CONSOLE );
 
-	strcpy( temppath, g_strTempPath.GetBuffer() );
+	Q_strncpyz( temppath, g_strTempPath.GetBuffer(), sizeof( temppath ) );
 
-	SaveWithRegion( name );
+	SaveWithRegion( name, sizeof( name ) );
 
 	const char *rsh = ValueForKey( g_qeglobals.d_project_entity, "rshcmd" );
 	if ( rsh == NULL ) {
@@ -1203,10 +1206,10 @@ void RunBsp( char *command ){
 
 		ExtractPath_and_Filename( name, strPath, strFile );
 		AddSlash( strPath );
-		strncpy( cWork, strPath, 1024 );
+		Q_strncpyz( cWork, strPath, 1024 );
-		strcat( cWork, strFile );
+		strncat( cWork, strFile, sizeof( cWork ) );
 	} else {
-		strcpy( cWork, name );
+		Q_strncpyz( cWork, name, sizeof( cWork ) );
 	}
 
 	// get the array ready
@@ -1217,7 +1220,7 @@ void RunBsp( char *command ){
 	if ( g_PrefsDlg.m_bWatchBSP ) {
 		// grab the file name for engine running
 		char *bspname = new char[1024];
-		ExtractFileName( currentmap, bspname );
+		ExtractFileName( currentmap, bspname, 1024 );
 		StripExtension( bspname );
 		g_pParentWnd->GetWatchBSP()->DoMonitoringLoop( sys, bspname );
 	} else {
@@ -1243,7 +1246,7 @@ void RunBsp( char *command ){
 #if defined ( __linux__ ) || defined ( __APPLE__ )
 
 		// write qe3bsp.sh
-		sprintf( batpath, "%sqe3bsp.sh", temppath );
+		snprintf( batpath, sizeof( batpath ), "%sqe3bsp.sh", temppath );
 		Sys_Printf( "Writing the compile script to '%s'\n", batpath );
 		hFile = fopen( batpath, "w" );
 		if ( !hFile ) {
@@ -1255,8 +1258,8 @@ void RunBsp( char *command ){
 		chmod( batpath, 0744 );
 #endif
 
-#ifdef _WIN32
+#if defined( _WIN32 )  || defined( __CYGWIN__ )
-		sprintf( batpath, "%sqe3bsp.bat", temppath );
+		snprintf( batpath, sizeof( batpath ), "%sqe3bsp.bat", temppath );
 		Sys_Printf( "Writing the compile script to '%s'\n", batpath );
 		Sys_Printf( "The build output will be saved in '%sjunk.txt'\n", temppath );
 		hFile = fopen( batpath, "w" );

radiant/mainframe.cpp

@@ -2174,7 +2174,7 @@ void clipboard_paste(){
 }
 
 
-#elif defined( WIN32 )
+#elif defined( _WIN32 )
 
 void clipboard_copy(){
 	Clipboard_CopyMap();
@@ -3435,7 +3435,7 @@ void MainFrame::LoadCommandMap(){
 
 #if defined ( __linux__ ) || defined ( __APPLE__ )
 	strINI = g_PrefsDlg.m_rc_path->str;
-#elif defined( WIN32 )
+#elif defined( _WIN32 ) || defined( __CYGWIN__ )
 	strINI = g_strGameToolsPath;
 #else
 #error "WTF are you compiling this on"
@@ -3450,7 +3450,7 @@ void MainFrame::LoadCommandMap(){
 		for ( int i = 0; i < g_nCommandCount; i++ )
 		{
 			char value[1024];
-			if ( read_var( strINI.GetBuffer(), "Commands", g_Commands[i].m_strCommand, value ) ) {
+			if ( read_var( strINI.GetBuffer(), "Commands", g_Commands[i].m_strCommand, value, sizeof( value ) ) ) {
 				if ( !bUserCmdList ) {
 					Sys_Printf( "Found user's shortcuts list at %s\n", strINI.GetBuffer() );
 					bUserCmdList = true;
@@ -3683,10 +3683,10 @@ void MainFrame::CreateQEChildren(){
 
         
         // check to see if the project template is versioned
-        strcpy( buf, g_pGameDescription->mEnginePath.GetBuffer() );
+        Q_strncpyz( buf, g_pGameDescription->mEnginePath.GetBuffer(), sizeof( buf ) );
-        strcat( buf, g_pGameDescription->mBaseGame.GetBuffer() );
+        strncat( buf, g_pGameDescription->mBaseGame.GetBuffer(), sizeof( buf ) );
-        strcat( buf, "/scripts/" );
+        strncat( buf, "/scripts/", sizeof( buf ) );
-        strcat( buf, PROJECT_TEMPLATE_NAME );
+        strncat( buf, PROJECT_TEMPLATE_NAME, sizeof( buf ) );
         templateVersion = QE_GetTemplateVersionForProject( buf );
 
 		r = g_PrefsDlg.m_strLastProject.GetBuffer();
@@ -3697,10 +3697,10 @@ void MainFrame::CreateQEChildren(){
 				// try default project location
 				bTriedTemplate = true;
 				// for all OSes, we look for the template in the base installation (no homepath here)
-				strcpy( buf, g_pGameDescription->mEnginePath.GetBuffer() );
+				Q_strncpyz( buf, g_pGameDescription->mEnginePath.GetBuffer(), sizeof( buf ) );
-				strcat( buf, g_pGameDescription->mBaseGame.GetBuffer() );
+				strncat( buf, g_pGameDescription->mBaseGame.GetBuffer(), sizeof( buf ) );
-				strcat( buf, "/scripts/" );
+				strncat( buf, "/scripts/", sizeof( buf ) );
-				strcat( buf, PROJECT_TEMPLATE_NAME );
+				strncat( buf, PROJECT_TEMPLATE_NAME, sizeof( buf ) );
 				r = buf;
 			}
 			else
@@ -3888,7 +3888,7 @@ void MainFrame::UpdateWindows( int nBits ){
 #ifdef DBG_WINDOWPOS
 	static int bean_count = 0;
 	char bean_buf[100];
-	sprintf( bean_buf,"UpdateWindows %d",bean_count );
+	snprintf( bean_buf, sizeof( bean_buf ), "UpdateWindows %d", bean_count );
 	CheckWatchit( bean_buf );
 	bean_count++;
 #endif
@@ -3923,7 +3923,7 @@ void MainFrame::UpdateWindows( int nBits ){
 		}
 	}
 #ifdef DBG_WINDOWPOS
-	sprintf( bean_buf,"%d (end UpdateWidows)",bean_count );
+	snprintf( bean_buf, sizeof( bean_buf ), "%d (end UpdateWidows)", bean_count );
 	CheckWatchit( bean_buf );
 #endif
 }
@@ -3932,7 +3932,7 @@ void MainFrame::RoutineProcessing(){
 #ifdef DBG_WINDOWPOS
 	static int bean_count = 0;
 	char bean_buf[100];
-	sprintf( bean_buf,"RoutineProcessing %d",bean_count );
+	snprintf( bean_buf, sizeof( bean_buf ), "RoutineProcessing %d", bean_count );
 	CheckWatchit( bean_buf );
 	bean_count++;
 #endif
@@ -4009,7 +4009,7 @@ void MainFrame::RoutineProcessing(){
  */
 	}
 #ifdef DBG_WINDOWPOS
-	sprintf( bean_buf,"%d (end RoutineProcessing)",bean_count );
+	snprintf( bean_buf, sizeof( bean_buf ), "%d (end RoutineProcessing)", bean_count );
 	CheckWatchit( bean_buf );
 #endif
 }
@@ -4258,8 +4258,8 @@ void MainFrame::OnFileOpen(){
 	char buf[NAME_MAX];
 
 	if ( !g_pGameDescription->noMapsInHome ) {
-		strcpy( buf, g_qeglobals.m_strHomeMaps.GetBuffer() );
+		Q_strncpyz( buf, g_qeglobals.m_strHomeMaps.GetBuffer(), sizeof( buf ) );
-		strcat( buf, "maps/" );
+		strncat( buf, "maps/", sizeof( buf ) );
 	}
 	else {
 		buf[0] = '\0';
@@ -4268,7 +4268,7 @@ void MainFrame::OnFileOpen(){
 	str = file_dialog( m_pWidget, TRUE, _( "Open Map" ), buf, MAP_MAJOR, "maps/" );
 
 	if ( str != NULL ) {
-		strcpy( currentmap,str );
+		Q_strncpyz( currentmap, str, sizeof( currentmap ) );
 		MRU_AddFile( str );
 		Map_LoadFile( str );
 	}
@@ -4279,8 +4279,8 @@ void MainFrame::OnFileImportmap(){
 	char buf[NAME_MAX];
 
 	if ( !g_pGameDescription->noMapsInHome ) {
-		strcpy( buf, g_qeglobals.m_strHomeMaps.GetBuffer() );
+		Q_strncpyz( buf, g_qeglobals.m_strHomeMaps.GetBuffer(), sizeof( buf ) );
-		strcat( buf, "maps/" );
+		strncat( buf, "maps/", sizeof( buf ) );
 	}
 	else {
 		buf[0] = '\0';
@@ -4307,8 +4307,8 @@ void MainFrame::OnFileSaveas(){
 	char buf[NAME_MAX];
 
 	if ( !g_pGameDescription->noMapsInHome ) {
-		strcpy( buf, g_qeglobals.m_strHomeMaps.GetBuffer() );
+		Q_strncpyz( buf, g_qeglobals.m_strHomeMaps.GetBuffer(), sizeof( buf ) );
-		strcat( buf, "maps/" );
+		strncat( buf, "maps/", sizeof( buf ) );
 	}
 	else {
 		buf[0] = '\0';
@@ -4317,7 +4317,7 @@ void MainFrame::OnFileSaveas(){
 	str = file_dialog( g_pParentWnd->m_pWidget, FALSE, _( "Save Map" ), buf, MAP_MAJOR, "maps/" );
 
 	if ( str != NULL ) {
-		strcpy( currentmap, str );
+		Q_strncpyz( currentmap, str, sizeof( currentmap ) );
 		MRU_AddFile( str );
 		Map_SaveFile( str, false ); // ignore region
 	}
@@ -4328,8 +4328,8 @@ void MainFrame::OnFileExportmap(){
 	char buf[NAME_MAX];
 
 	if ( !g_pGameDescription->noMapsInHome ) {
-		strcpy( buf, g_qeglobals.m_strHomeMaps.GetBuffer() );
+		Q_strncpyz( buf, g_qeglobals.m_strHomeMaps.GetBuffer(), sizeof( buf ) );
-		strcat( buf, "maps/" );
+		strncat( buf, "maps/", sizeof( buf ) );
 	}
 	else {
 		buf[0] = '\0';
@@ -4347,8 +4347,8 @@ void MainFrame::OnFileSaveregion(){
 	char buf[NAME_MAX];
 
 	if ( !g_pGameDescription->noMapsInHome ) {
-		strcpy( buf, g_qeglobals.m_strHomeMaps.GetBuffer() );
+		Q_strncpyz( buf, g_qeglobals.m_strHomeMaps.GetBuffer(), sizeof( buf ) );
-		strcat( buf, "maps/" );
+		strncat( buf, "maps/", sizeof( buf ) );
 	}
 	else {
 		buf[0] = '\0';
@@ -5716,9 +5716,9 @@ void MainFrame::OnTexturesLoad(){
 	// FIXME
 	// check if that works with fs_game (I suspect some more design is needed)
 	// see how this is done in 1.2?
-	strcpy( def_path, g_pGameDescription->mEnginePath.GetBuffer() );
+	Q_strncpyz( def_path, g_pGameDescription->mEnginePath.GetBuffer(), sizeof( def_path ) );
-	strcat( def_path, g_pGameDescription->mBaseGame.GetBuffer() );
+	strncat( def_path, g_pGameDescription->mBaseGame.GetBuffer(), sizeof( def_path ) );
-	strcat( def_path, "/" );
+	strncat( def_path, "/", sizeof( def_path ) );
 
 	char *dir = dir_dialog( m_pWidget, _( "Load textures from path" ), def_path );
 
@@ -5731,7 +5731,7 @@ void MainFrame::OnTexturesLoad(){
 		}
 		char *pouic = MAX( strrchr( dir, '/' ),strrchr( dir, '\\' ) );
 		if ( pouic ) {
-			strcpy( texture_directory, pouic + 1 );
+			Q_strncpyz( texture_directory, pouic + 1, 128 );
 			Sys_Printf( "Loading '%s'\n", texture_directory );
 			Texture_ShowDirectory();
 		}
@@ -6156,8 +6156,8 @@ void MainFrame::OnMiscSelectentitycolor(){
 		}
 
 		if ( inspector_mode == W_ENTITY && ( DoColor( COLOR_ENTITY ) ) ) {
-			char buffer[100];
+			char buffer[256];
-			sprintf( buffer, "%f %f %f", g_qeglobals.d_savedinfo.colors[COLOR_ENTITY][0],
+			snprintf( buffer, sizeof( buffer ), "%f %f %f", g_qeglobals.d_savedinfo.colors[COLOR_ENTITY][0],
 					 g_qeglobals.d_savedinfo.colors[COLOR_ENTITY][1],
 					 g_qeglobals.d_savedinfo.colors[COLOR_ENTITY][2] );
 

radiant/map.cpp

@@ -549,7 +549,7 @@ void Map_LoadFile( const char *filename ){
 	// used when conversion between standard map format and BP format is required and the user cancels the process
 	g_bCancel_Map_LoadFile = false;
 
-	strcpy( currentmap, filename );
+	Q_strncpyz( currentmap, filename, sizeof( currentmap ) );
 
 	g_bScreenUpdates = false; // leo: avoid redraws while loading the map (see fenris:1952)
 
@@ -778,9 +778,9 @@ void Map_SaveFile( const char *filename, qboolean use_region ){
 		char backup[1024];
 
 		// rename current to .bak
-		strcpy( backup, filename );
+		Q_strncpyz( backup, filename, sizeof( backup ) );
 		StripExtension( backup );
-		strcat( backup, ".bak" );
+		strncat( backup, ".bak", sizeof( backup ) );
 		unlink( backup );
 		rename( filename, backup );
 	}
@@ -830,7 +830,7 @@ void Map_New( void ){
 	Sys_Printf( "Map_New\n" );
 	Map_Free();
 
-	strcpy( currentmap, "unnamed.map" );
+	Q_strncpyz( currentmap, "unnamed.map", sizeof( currentmap ) );
 	Sys_SetTitle( currentmap );
 
 	world_entity = (entity_s*)qmalloc( sizeof( *world_entity ) );
@@ -932,9 +932,9 @@ void AddRegionBrushes( void ){
 	SetKeyValue( region_startpoint, "classname", "info_player_start" );
 	region_startpoint->eclass = Eclass_ForName( "info_player_start", false );
 	char sTmp[1024];
-	sprintf( sTmp, "%d %d %d", (int)vOrig[0], (int)vOrig[1], (int)vOrig[2] );
+	snprintf( sTmp, sizeof( sTmp ), "%d %d %d", (int)vOrig[0], (int)vOrig[1], (int)vOrig[2] );
 	SetKeyValue( region_startpoint, "origin", sTmp );
-	sprintf( sTmp, "%d", (int)g_pParentWnd->GetCamWnd()->Camera()->angles[YAW] );
+	snprintf( sTmp, sizeof( sTmp ), "%d", (int)g_pParentWnd->GetCamWnd()->Camera()->angles[YAW] );
 	SetKeyValue( region_startpoint, "angle", sTmp );
 	// empty array of children
 	region_startpoint->pData = new CPtrArray;
@@ -1272,7 +1272,7 @@ void MemFile_fprintf( MemStream* pMemFile, const char* pText, ... ){
 	char Buffer[4096];
 	va_list args;
 	va_start( args,pText );
-	vsprintf( Buffer, pText, args );
+	vsnprintf( Buffer, sizeof( Buffer ), pText, args );
 	pMemFile->Write( Buffer, strlen( Buffer ) );
 }
 

radiant/missing.cpp

@@ -115,7 +115,7 @@ bool radCreateDirectory( const char *directory, bool fatal_on_error ) {
 
 int GetFullPathName( const char *lpFileName, int nBufferLength, char *lpBuffer, char **lpFilePart ){
 	if ( lpFileName[0] == '/' ) {
-		strcpy( lpBuffer, lpFileName );
+		Q_strncpyz( lpBuffer, lpFileName, nBufferLength );
 		*lpFilePart = strrchr( lpBuffer, '/' );
 		return strlen( lpBuffer );
 	}
@@ -124,9 +124,9 @@ int GetFullPathName( const char *lpFileName, int nBufferLength, char *lpBuffer,
 		return 0;
 	}
 
-	strcat( lpBuffer, "/" );
+	strncat( lpBuffer, "/", nBufferLength );
 	*lpFilePart = lpBuffer + strlen( lpBuffer );
-	strcat( lpBuffer, lpFileName );
+	strncat( lpBuffer, lpFileName, nBufferLength );
 
 	char *scr = lpBuffer, *dst = lpBuffer;
 	for ( int i = 0; ( i < nBufferLength ) && ( *scr != 0 ); i++ )

radiant/pluginentities.cpp

@@ -33,7 +33,7 @@
 #endif
 //#include "qe3.h"
 
-int QERApp_EClassScanDir( char *path, void* hPlug ){
+int QERApp_EClassScanDir( const char *path, void* hPlug ){
 	char temp[NAME_MAX];
 	char filebase[NAME_MAX];
 	char filename[NAME_MAX];
@@ -43,7 +43,7 @@ int QERApp_EClassScanDir( char *path, void* hPlug ){
 	struct dirent *dirlist;
 
 	QE_ConvertDOSToUnixName( temp, path );
-	strcpy( filebase, path );
+	Q_strncpyz( filebase, path, sizeof( filebase ) );
 	s = filebase + strlen( filebase ) - 1;
 	while ( *s != '\\' && *s != '/' && s != filebase )
 		s--;
@@ -53,7 +53,7 @@ int QERApp_EClassScanDir( char *path, void* hPlug ){
 	if ( dir != NULL ) {
 		while ( ( dirlist = readdir( dir ) ) != NULL )
 		{
-			sprintf( filename, "%s/%s", filebase, dirlist->d_name );
+			snprintf( filename, sizeof( filename ), "%s/%s", filebase, dirlist->d_name );
 			Eclass_ScanFile( filename );
 
 			if ( eclass_found ) {

radiant/pluginmanager.cpp

@@ -495,7 +495,11 @@ CPluginSlot::~CPluginSlot(){
 void CPluginSlot::Init(){
 	CString str =   mpTable->m_pfnQERPlug_GetCommandList();
 	char cTemp[1024];
-	strcpy( cTemp, str );
+	Q_strncpyz( cTemp, str, sizeof( cTemp ) );
+	if( str.GetLength() > sizeof( cTemp ) - 1 )
+	{
+		Sys_FPrintf( SYS_WRN, "WARNING: Temporary buffer is too small in CPluginSlot::Init\n" );
+	}
 	char* token = strtok( cTemp, ",;" );
 	if ( token && *token == ' ' ) {
 		while ( *token == ' ' )
@@ -1090,7 +1094,7 @@ _QERFaceData* WINAPI QERApp_GetFaceData( void* pv, int nFaceIndex ){
 					face.m_fShift[0] = f->texdef.shift[0];
 					face.m_fShift[1] = f->texdef.shift[1];
 				}
-				strcpy( face.m_TextureName, f->texdef.GetName() );
+				Q_strncpyz( face.m_TextureName, f->texdef.GetName(), sizeof( face.m_TextureName ) );
 				VectorCopy( f->planepts[0], face.m_v1 );
 				VectorCopy( f->planepts[1], face.m_v2 );
 				VectorCopy( f->planepts[2], face.m_v3 );
@@ -1298,7 +1302,7 @@ char* WINAPI QERApp_GetTexture( int nIndex ){
 			break;
 		}
 		if ( n == nIndex ) {
-			strcpy( name, pShader->getName() );
+			Q_strncpyz( name, pShader->getName(), sizeof( name ) );
 			return name;
 		}
 		n++;
@@ -1308,7 +1312,7 @@ char* WINAPI QERApp_GetTexture( int nIndex ){
 
 char* WINAPI QERApp_GetCurrentTexture(){
 	static char current_tex[1024];
-	strcpy( current_tex,g_qeglobals.d_texturewin.texdef.GetName() );
+	Q_strncpyz( current_tex, g_qeglobals.d_texturewin.texdef.GetName(), sizeof( current_tex ) );
 	return current_tex;
 }
 
@@ -1518,7 +1522,7 @@ int QERApp_ScriptLine(){
 // we save the map and return the name .. either .map or .reg to support region compiling
 char* QERApp_GetMapName(){
 	static char name[PATH_MAX];
-	SaveWithRegion( name );
+	SaveWithRegion( name, sizeof( name ) );
 	return name;
 }
 

radiant/pmesh.cpp

@@ -4755,7 +4755,7 @@ void Patch_AdjustSelected( bool bInsert, bool bColumn, bool bFlag ){
    strategies that call here too much are known to be slow
    patch 84 to bug 253 adds an additionnal check for textures/
  */
-void CheckName( patchMesh_t *p, char *pname ){
+void CheckName( patchMesh_t *p, char *pname, size_t length ){
 	if ( strncmp( p->pShader->getName(), "textures/", 9 ) != 0 ) {
 		p->pShader = QERApp_Shader_ForName( SHADER_NOT_FOUND );
 	}
@@ -4763,15 +4763,15 @@ void CheckName( patchMesh_t *p, char *pname ){
 	// some manage to get long filename textures (with spaces) in their maps
 	if ( strchr( p->pShader->getName(), ' ' ) ) {
 		char Msg1[1024];
-		sprintf( Msg1, "Can't save texture with spaces in name. Rename %s\nNOTE: This message may popup several times .. once for each buggy face detected.", p->pShader->getName() );
+		snprintf( Msg1, sizeof( Msg1 ), "Can't save texture with spaces in name. Rename %s\nNOTE: This message may popup several times .. once for each buggy face detected.", p->pShader->getName() );
 		Sys_Printf( "%s\n", Msg1 );
 		gtk_MessageBox( g_pParentWnd->m_pWidget, Msg1, "Error saving map", MB_OK );
-		strcpy( pname, SHADER_NOT_FOUND );
+		Q_strncpyz( pname, SHADER_NOT_FOUND, length );
 		p->pShader = QERApp_Shader_ForName( SHADER_NOT_FOUND );
 		p->d_texture = p->pShader->getTexture();
 		return;
 	}
-	strcpy( pname, p->pShader->getName() + 9 ); // remove "textures/"
+	Q_strncpyz( pname, p->pShader->getName() + 9, length ); // remove "textures/"
 }
 
 /*
@@ -4784,7 +4784,7 @@ void Patch_Write( patchMesh_t *p, MemStream *file ){
 
 	MemFile_fprintf( file, " {\n  patchDef2\n  {\n" );
 
-	CheckName( p, pname );
+	CheckName( p, pname, sizeof( pname ) );
 	MemFile_fprintf( file, "   %s\n", pname );
 	MemFile_fprintf( file, "   ( %i %i %i %i %i ) \n", p->width, p->height, p->contents, p->flags, p->value );
 
@@ -4823,7 +4823,7 @@ void Patch_Write( patchMesh_t *p, FILE *file ){
 
 	fprintf( file, " {\n  patchDef2\n  {\n" );
 	{
-		CheckName( p, pname );
+		CheckName( p, pname, sizeof( pname ) );
 		fprintf( file, "   %s\n", pname );
 		fprintf( file, "   ( %i %i %i %i %i ) \n", p->width, p->height, p->contents, p->flags, p->value );
 	}

radiant/points.cpp

@@ -72,9 +72,9 @@ void CPointfile::GenerateDisplayList(){
 void Pointfile_Delete( void ){
 	char name[1024];
 
-	strcpy( name, currentmap );
+	Q_strncpyz( name, currentmap, sizeof( name ) );
 	StripExtension( name );
-	strcat( name, ".lin" );
+	strncat( name, ".lin", sizeof( name ) );
 
 	remove( name );
 }
@@ -125,9 +125,9 @@ void WINAPI Pointfile_Check( void ){
 	int line = 1;
 	vec3_t v;
 
-	strcpy( name, currentmap );
+	Q_strncpyz( name, currentmap, sizeof( name ) );
 	StripExtension( name );
-	strcat( name, ".lin" );
+	strncat( name, ".lin", sizeof( name ) );
 
 	size = vfsLoadFullPathFile( name, (void**)&data );
 	if ( size <= 0 ) {

radiant/preferences.cpp

@@ -229,7 +229,7 @@ void WindowPosition_Parse( window_position_t& m_value, const CString& value ){
 
 void WindowPosition_Write( const window_position_t& m_value, CString& value ){
 	char buffer[64];
-	sprintf( buffer, "%d %d %d %d", m_value.x, m_value.y, m_value.w, m_value.h );
+	snprintf( buffer, sizeof( buffer ), "%d %d %d %d", m_value.x, m_value.y, m_value.w, m_value.h );
 	value = buffer;
 }
 
@@ -307,8 +307,8 @@ void CXMLPropertyBag::GetPref( const char *name, int *pV, int V ){
 	}
 	else
 	{
-		char s[10];
+		char s[12];
-		sprintf( s, "%d", V );
+		snprintf( s, sizeof( s ), "%d", V );
 		pNode = xmlNewChild( mpDocNode, NULL, (xmlChar *)"epair", (xmlChar *)s );
 		xmlSetProp( pNode, (xmlChar *)"name", (xmlChar *)name );
 		*pV = V;
@@ -347,8 +347,8 @@ void CXMLPropertyBag::GetPref( const char *name, float *pV, float V ){
 	}
 	else
 	{
-		char s[10];
+		char s[64];
-		sprintf( s, "%f", V );
+		snprintf( s, sizeof( s ), "%f", V );
 		pNode = xmlNewChild( mpDocNode, NULL, (xmlChar *)"epair", (xmlChar *)s );
 		xmlSetProp( pNode, (xmlChar *)"name", (xmlChar *)name );
 		*pV = V;
@@ -364,8 +364,8 @@ void CXMLPropertyBag::GetPref( const char *name, float* pV, float* V ){
 	}
 	else
 	{
-		char s[128];
+		char s[256];
-		sprintf( s, "%f %f %f", V[0], V[1], V[2] );
+		snprintf( s, sizeof( s ), "%f %f %f", V[0], V[1], V[2] );
 		pNode = xmlNewChild( mpDocNode, NULL, (xmlChar *)"epair", (xmlChar *)s );
 		xmlSetProp( pNode, (xmlChar *)"name", (xmlChar *)name );
 		pV[0] = V[0];
@@ -401,7 +401,7 @@ void CXMLPropertyBag::UpdatePrefTree(){
 		CPrefAssignment *pPref = &( *iPref );
 		// look for the node
 		xmlNodePtr pNode;
-		char s[64];
+		char s[256];
 
 		pNode = EpairForName( pPref->mName.GetBuffer() );
 		// we never expect that the node could not be found, because this is supposed to happen
@@ -416,11 +416,11 @@ void CXMLPropertyBag::UpdatePrefTree(){
 			xmlNodeSetContent( pNode, (const xmlChar *)( (Str *)pPref->mVal )->GetBuffer() );
 			break;
 		case PREF_INT:
-			sprintf( s, "%d", *(int *)pPref->mVal );
+			snprintf( s, sizeof( s ), "%d", *(int *)pPref->mVal );
 			xmlNodeSetContent( pNode, (xmlChar *)s );
 			break;
 		case PREF_FLOAT:
-			sprintf( s, "%f", *(float *)pPref->mVal );
+			snprintf( s, sizeof( s ), "%f", *(float *)pPref->mVal );
 			xmlNodeSetContent( pNode, (xmlChar *)s );
 			break;
 		case PREF_BOOL:
@@ -430,7 +430,7 @@ void CXMLPropertyBag::UpdatePrefTree(){
 		case PREF_VEC3:
 		{
 			float* v = (float*)pPref->mVal;
-			sprintf( s, "%f %f %f", v[0], v[1], v[2] );
+			snprintf( s, sizeof( s ), "%f %f %f", v[0], v[1], v[2] );
 			xmlNodeSetContent( pNode, (xmlChar *)s );
 		}
 		break;
@@ -501,7 +501,7 @@ qboolean CXMLPropertyBag::WriteXMLFile( const char* pFilename ){
 // =============================================================================
 // Widget callbacks for PrefsDlg
 
-#if !defined( WIN32 )
+#if !defined( _WIN32 )
 // browse for custom editor executable
 static void OnBtnBrowseEditor( GtkWidget *widget, gpointer data ){
 	PrefsDlg *dlg = (PrefsDlg*)data;
@@ -523,7 +523,7 @@ static void OnBtnBrowseprefab( GtkWidget *widget, gpointer data ){
 	if ( strlen( path ) == 0 ) {
 		path = g_strGameToolsPath;
 	}
-	char *dir = dir_dialog( g_PrefsDlg.GetWidget(), _( "Set prefab path" ), path );
+	gchar *dir = dir_dialog( g_PrefsDlg.GetWidget(), _( "Set prefab path" ), path );
 	dlg->UpdateData( TRUE );
 
 	if ( dir != NULL ) {
@@ -564,7 +564,7 @@ static void OnButtonClean( GtkWidget *widget, gpointer data ){
 		g_qeglobals.disable_ini = true;
 		remove( dlg->m_inipath->str );
 		char buf[PATH_MAX];
-		sprintf( buf, "%sSavedInfo.bin", dlg->m_rc_path->str );
+		snprintf( buf, sizeof( buf ), "%sSavedInfo.bin", dlg->m_rc_path->str );
 		remove( buf );
 		HandleCommand( NULL, GINT_TO_POINTER( ID_FILE_EXIT ) );
 		_exit( 0 );
@@ -729,9 +729,9 @@ CGameDescription::CGameDescription( xmlDocPtr pDoc, const Str &GameFile ){
 	{
 		char full[PATH_MAX];
 #ifdef _WIN32
-		_fullpath( full, prop, PATH_MAX );
+		_fullpath( full, prop, sizeof( full ) );
 #else
-		strncpy( full, prop, PATH_MAX );
+		Q_strncpyz( full, prop, sizeof( full ) );
 #endif
 		xmlFree( prop );
 		prop = NULL;
@@ -822,9 +822,9 @@ CGameDescription::CGameDescription( xmlDocPtr pDoc, const Str &GameFile ){
 		if ( prop != NULL ) {
 			char full[PATH_MAX];
 		#ifdef _WIN32
-			_fullpath( full, prop, PATH_MAX );
+			_fullpath( full, prop, sizeof( full ) );
 		#else
-			strncpy( full, prop, PATH_MAX );
+			Q_strncpyz( full, prop, sizeof( full ) );
 		#endif
 			xmlFree( prop );
 			prop = NULL;
@@ -844,12 +844,12 @@ CGameDescription::CGameDescription( xmlDocPtr pDoc, const Str &GameFile ){
 			// if engine path was not specified in the .game, it implies we can guess it from the gametools path
 			// on win32, and for most game package, the gametools are installed with the game
 			char aux_path[PATH_MAX]; // aux
-			strcpy( aux_path, mGameToolsPath.GetBuffer() );
+			Q_strncpyz( aux_path, mGameToolsPath.GetBuffer(), sizeof( aux_path ) );
 			if ( ( aux_path[ strlen( aux_path ) - 1 ] == '/' ) || ( aux_path[ strlen( aux_path ) - 1 ] == '\\' ) ) {
 				aux_path[strlen( aux_path ) - 1] = '\0'; // strip ending '/' if any
 			}
 			char up_path[PATH_MAX]; // up one level
-			ExtractFilePath( aux_path, up_path );
+			ExtractFilePath( aux_path, up_path, sizeof( up_path ) );
 			mEnginePath = up_path;
 		}
 	}
@@ -3087,7 +3087,7 @@ void PrefsDlg::LoadPrefs(){
 	for ( i = 0; i < 4; i++ )
 	{
 		char buf[64];
-		sprintf( buf, "%s%d", FILE_KEY, i );
+		snprintf( buf, sizeof( buf ), "%s%d", FILE_KEY, i );
 		mLocalPrefs.GetPref( buf,                  &m_strMRUFiles[i],              "" );
 	}
 
@@ -3130,7 +3130,7 @@ void PrefsDlg::LoadPrefs(){
 
 	for ( i = 0; i < 3; i++ ) {
 		char buf[64];
-		sprintf( buf, "%s%d", SI_AXISCOLORS_KEY, i );
+		snprintf( buf, sizeof( buf ), "%s%d", SI_AXISCOLORS_KEY, i );
 		mLocalPrefs.GetPref( buf,   g_qeglobals.d_savedinfo.AxisColors[i], vDefaultAxisColours[i] );
 	}
 
@@ -3154,7 +3154,7 @@ void PrefsDlg::LoadPrefs(){
 
 	for ( i = 0; i < COLOR_LAST; i++ ) {
 		char buf[64];
-		sprintf( buf, "%s%d", SI_COLORS_KEY, i );
+		snprintf( buf, sizeof( buf ), "%s%d", SI_COLORS_KEY, i );
 		mLocalPrefs.GetPref( buf,   g_qeglobals.d_savedinfo.colors[i], vDefaultColours[i] );
 	}
 

radiant/profile.cpp

@@ -46,7 +46,7 @@
 // =============================================================================
 // Static functions
 
-bool read_var( const char *filename, const char *section, const char *key, char *value ){
+bool read_var( const char *filename, const char *section, const char *key, char *value, size_t length ){
 	char line[1024], *ptr;
 	FILE *rc;
 
@@ -83,7 +83,7 @@ bool read_var( const char *filename, const char *section, const char *key, char
 					line[strlen( line ) - 1] = '\0';
 
 				if ( strcmp( line, key ) == 0 ) {
-					strcpy( value, ptr + 1 );
+					Q_strncpyz( value, ptr + 1, length );
 					fclose( rc );
 
 					if ( value[strlen( value ) - 1] == 10 || value[strlen( value ) - 1] == 13 || value[strlen( value ) - 1] == 32 ) {
@@ -187,13 +187,13 @@ static bool save_var( const char *filename, const char *section, const char *key
 
 bool WINAPI profile_save_int( const char *filename, const char *section, const char *key, int value ){
 	char buf[16];
-	sprintf( buf, "%d", value );
+	snprintf( buf, sizeof( buf ), "%d", value );
 	return save_var( filename, section, key, buf );
 }
 
 bool WINAPI profile_save_float( const char *filename, const char *section, const char *key, float value ){
-	char buf[16];
+	char buf[64];
-	sprintf( buf, "%f", value );
+	snprintf( buf, sizeof( buf ), "%f", value );
 	return save_var( filename, section, key, buf );
 }
 
@@ -204,7 +204,7 @@ bool WINAPI profile_save_string( const char * filename, const char *section, con
 bool profile_save_buffer( const char * rc_path, const char *name, void *buffer, guint32 size ){
 	bool ret = false;
 	char filename[PATH_MAX];
-	sprintf( filename, "%s/%s.bin", rc_path, name );
+	snprintf( filename, sizeof( filename ), "%s/%s.bin", rc_path, name );
 	FILE *f;
 
 	f = fopen( filename, "wb" );
@@ -222,7 +222,7 @@ bool profile_save_buffer( const char * rc_path, const char *name, void *buffer,
 
 bool profile_load_buffer( const char * rc_path, const char *name, void *buffer, guint32 *plSize ){
 	char filename[PATH_MAX];
-	sprintf( filename, "%s/%s.bin", rc_path, name );
+	snprintf( filename, sizeof( filename ), "%s/%s.bin", rc_path, name );
 	bool ret = false;
 	guint32 len;
 	FILE *f;
@@ -254,7 +254,7 @@ bool profile_load_buffer( const char * rc_path, const char *name, void *buffer,
 int WINAPI profile_load_int( const char *filename, const char *section, const char *key, int default_value ){
 	char value[1024];
 
-	if ( read_var( filename, section, key, value ) ) {
+	if ( read_var( filename, section, key, value, sizeof( value ) ) ) {
 		return atoi( value );
 	}
 	else{
@@ -265,7 +265,7 @@ int WINAPI profile_load_int( const char *filename, const char *section, const ch
 float WINAPI profile_load_float( const char *filename, const char *section, const char *key, float default_value ){
 	char value[1024];
 
-	if ( read_var( filename, section, key, value ) ) {
+	if ( read_var( filename, section, key, value, sizeof( value ) ) ) {
 		return atof( value );
 	}
 	else{
@@ -277,7 +277,7 @@ char* WINAPI profile_load_string( const char *filename, const char *section, con
 	static Str ret;
 	char value[1024];
 
-	if ( read_var( filename, section, key, value ) ) {
+	if ( read_var( filename, section, key, value, sizeof( value ) ) ) {
 		ret = value;
 	}
 	else{

radiant/qe3.cpp

@@ -100,7 +100,7 @@ void WINAPI QE_CheckOpenGLForErrors( void ){
 	int i = qglGetError();
 	if ( i != GL_NO_ERROR ) {
 		if ( i == GL_OUT_OF_MEMORY ) {
-			sprintf( strMsg, "OpenGL out of memory error %s\nDo you wish to save before exiting?", qgluErrorString( (GLenum)i ) );
+			snprintf( strMsg, sizeof( strMsg ), "OpenGL out of memory error %s\nDo you wish to save before exiting?", qgluErrorString( (GLenum)i ) );
 			if ( gtk_MessageBox( g_pParentWnd->m_pWidget, strMsg, "Radiant Error", MB_YESNO ) == IDYES ) {
 				Map_SaveFile( NULL, false );
 			}
@@ -126,7 +126,7 @@ char *ExpandReletivePath( char *p ){
 	}
 
 	base = ValueForKey( g_qeglobals.d_project_entity, "basepath" );
-	sprintf( temp, "%s/%s", base, p );
+	snprintf( temp, sizeof( temp ), "%s/%s", base, p );
 	return temp;
 }
 
@@ -197,7 +197,7 @@ void Map_Snapshot(){
 			char buf[PATH_MAX];
 			//sprintf( buf, "%s.%i", strNewPath.GetBuffer(), nCount );
 			// snapshot will now end with a known ext.
-			sprintf( buf, "%s.%i.%s", strNewPath.GetBuffer(), nCount, strOldEXT.GetBuffer() );
+			snprintf( buf, sizeof( buf ), "%s.%i.%s", strNewPath.GetBuffer(), nCount, strOldEXT.GetBuffer() );
 			strFile = buf;
 			bGo = DoesFileExist( strFile, lSize );
 			nCount++;
@@ -282,7 +282,7 @@ int BuildShortPathName( const char* pPath, char* pBuffer, int nBufferLen ){
 	int nResult = GetFullPathName( pPath, nBufferLen, pBuffer, &pFile );
 	nResult = GetShortPathName( pPath, pBuffer, nBufferLen );
 	if ( nResult == 0 ) {
-		strcpy( pBuffer, pPath );               // Use long filename
+		Q_strncpyz( pBuffer, pPath, nBufferLen );               // Use long filename
 	}
 	return nResult;
 }
@@ -354,7 +354,7 @@ void HandleXMLError( void* ctxt, const char* text, ... ){
 	static char buf[32768];
 
 	va_start( argptr,text );
-	vsprintf( buf, text, argptr );
+	vsnprintf( buf, sizeof( buf ), text, argptr );
 	Sys_FPrintf( SYS_ERR, "XML %s\n", buf );
 	va_end( argptr );
 }
@@ -598,7 +598,8 @@ bool QE_LoadProject( const char *projectfile ){
 	int ver = IntForKey( g_qeglobals.d_project_entity, "version" );
 	if ( ver > PROJECT_VERSION ) {
 		char strMsg[1024];
-		sprintf( strMsg, "This is a version %d project file. This build only supports <=%d project files.\n"
+		snprintf( strMsg, sizeof( strMsg ),
+			"This is a version %d project file. This build only supports <=%d project files.\n"
 			"Please choose another project file or upgrade your version of Radiant.", ver, PROJECT_VERSION );
 		gtk_MessageBox( g_pParentWnd->m_pWidget, strMsg, "Can't load project file", MB_ICONERROR | MB_OK );
 		// set the project file to nothing so we are sure we'll ask next time?
@@ -645,7 +646,7 @@ bool QE_LoadProject( const char *projectfile ){
 
 		if ( IntForKey( g_qeglobals.d_project_entity, "version" ) != PROJECT_VERSION ) {
 			char strMsg[2048];
-			sprintf( strMsg,
+			snprintf( strMsg, sizeof( strMsg ), 
 					 "The template project '%s' has version %d. The editor binary is configured for version %d.\n"
 					 "This indicates a problem in your setup.\n"
 					 "I will keep going with this project till you fix this",
@@ -654,19 +655,19 @@ bool QE_LoadProject( const char *projectfile ){
 		}
 
 		// create the writable project file path
-		strcpy( buf, g_qeglobals.m_strHomeGame.GetBuffer() );
+		Q_strncpyz( buf, g_qeglobals.m_strHomeGame.GetBuffer(), sizeof( buf ) );
-		strcat( buf, g_pGameDescription->mBaseGame.GetBuffer() );
+		strncat( buf, g_pGameDescription->mBaseGame.GetBuffer(), sizeof( buf ) );
-		strcat( buf, G_DIR_SEPARATOR_S "scripts" G_DIR_SEPARATOR_S );
+		strncat( buf, G_DIR_SEPARATOR_S "scripts" G_DIR_SEPARATOR_S, sizeof( buf ) );
 		// while the filename is already in use, increment the number we add to the end
 		int counter = 0;
 		char pUser[PATH_MAX];
 		while ( 1 )
 		{
-			sprintf( pUser, "%suser%d." PROJECT_FILETYPE, buf, counter );
+			snprintf( pUser, sizeof( pUser ), "%suser%d." PROJECT_FILETYPE, buf, counter );
 			counter++;
 			if ( access( pUser, R_OK ) != 0 ) {
 				// this is the one
-				strcpy( buf, pUser );
+				Q_strncpyz( buf, pUser, sizeof( buf ) );
 				break;
 			}
 		}
@@ -1266,7 +1267,7 @@ void Sys_MarkMapModified( void ){
 
 	if ( modified != 1 ) {
 		modified = true; // mark the map as changed
-		sprintf( title, "%s *", currentmap );
+		snprintf( title, sizeof( title ), "%s *", currentmap );
 
 		QE_ConvertDOSToUnixName( title, title );
 		Sys_SetTitle( title );
@@ -1337,7 +1338,7 @@ void Sys_UpdateStatusBar( void ){
 
 	char numbrushbuffer[100] = "";
 
-	sprintf( numbrushbuffer, "Brushes: %d Entities: %d", g_numbrushes, g_numentities );
+	snprintf( numbrushbuffer, sizeof( numbrushbuffer ), "Brushes: %d Entities: %d", g_numbrushes, g_numentities );
 	g_pParentWnd->SetStatusText( 2, numbrushbuffer );
 	//Sys_Status( numbrushbuffer, 2 );
 }
@@ -1372,11 +1373,11 @@ void buffer_write_escaped_mnemonic( char* buffer, const char* string ){
 }
 
 static void MRU_SetText( int index, const char *filename ){
-	strcpy( MRU_filenames[index], filename );
+	Q_strncpyz( MRU_filenames[index], filename, sizeof( MRU_filenames[index] ) );
 
 	char mnemonic[PATH_MAX * 2 + 4];
 	mnemonic[0] = '_';
-	sprintf( mnemonic + 1, "%d", index + 1 );
+	snprintf( mnemonic + 1, sizeof( mnemonic ) - 1, "%d", index + 1 );
 	mnemonic[2] = '-';
 	mnemonic[3] = ' ';
 	buffer_write_escaped_mnemonic( mnemonic + 4, filename );
@@ -1510,9 +1511,9 @@ void ProjectDialog(){
 	 * store it in buffer.
 	 */
 
-	strcpy( buffer, g_qeglobals.m_strHomeGame.GetBuffer() );
+	Q_strncpyz( buffer, g_qeglobals.m_strHomeGame.GetBuffer(), sizeof( buffer ) );
-	strcat( buffer, g_pGameDescription->mBaseGame.GetBuffer() );
+	strncat( buffer, g_pGameDescription->mBaseGame.GetBuffer(), sizeof( buffer ) );
-	strcat( buffer, "/scripts/" );
+	strncat( buffer, "/scripts/", sizeof( buffer ) );
 
 	// Display the Open dialog box
 	filename = file_dialog( NULL, TRUE, _( "Open File" ), buffer, "project" );
@@ -1569,7 +1570,7 @@ void FillBSPMenu(){
 	if ( g_qeglobals.bBSPFrontendPlugin ) {
 		CString str = g_BSPFrontendTable.m_pfnGetBSPMenu();
 		char cTemp[1024];
-		strcpy( cTemp, str );
+		Q_strncpyz( cTemp, str, sizeof( cTemp ) );
 		char* token = strtok( cTemp, ",;" );
 		if ( token && *token == ' ' ) {
 			while ( *token == ' ' )

radiant/qe3.h

@@ -271,7 +271,7 @@ int WINAPI profile_load_int( const char *filename, const char *section, const ch
 float WINAPI profile_load_float( const char *filename, const char *section, const char *key, float default_value );
 char* WINAPI profile_load_string( const char *filename, const char *section, const char *key, const char *default_value );
 // used in the command map code
-bool read_var( const char *filename, const char *section, const char *key, char *value );
+bool read_var( const char *filename, const char *section, const char *key, char *value, size_t length );
 
 //
 // entityw.c
@@ -793,7 +793,7 @@ extern void CheckBspProcess();
 extern void QE_CountBrushesAndUpdateStatusBar();
 extern void QE_CheckAutoSave();
 extern qtexture_t   *current_texture;
-extern void SaveWithRegion( char *name ); // save the current map, sets the map name in the name buffer (deals with regioning)
+extern void SaveWithRegion( char *name, size_t length ); // save the current map, sets the map name in the name buffer (deals with regioning)
 extern void RunBsp( char *command );
 extern void Map_Snapshot();
 extern void WXY_Print();

radiant/select.cpp

@@ -755,7 +755,7 @@ void Select_ApplyMatrix( bool bSnap, bool bRotation, int nAxis, float fDeg ){ //
 
 			// update the origin key
 			char text[64];
-			sprintf( text, "%i %i %i",
+			snprintf( text, sizeof( text ), "%i %i %i",
 					 (int)b->owner->origin[0], (int)b->owner->origin[1], (int)b->owner->origin[2] );
 			SetKeyValue( b->owner, "origin", text );
 

radiant/selectedface.cpp

@@ -60,7 +60,7 @@ int WINAPI QERApp_GetFaceInfo( int iface, _QERFaceData *pFaceData, winding_t *pW
 		return 0;
 	}
 	face_t *selFace = reinterpret_cast<face_t*>( g_ptrSelectedFaces.GetAt( iface ) );
-	strcpy( pFaceData->m_TextureName, selFace->texdef.GetName() );
+	Q_strncpyz( pFaceData->m_TextureName, selFace->texdef.GetName(), sizeof( pFaceData->m_TextureName ) );
 	VectorCopy( selFace->planepts[0], pFaceData->m_v1 );
 	VectorCopy( selFace->planepts[1], pFaceData->m_v2 );
 	VectorCopy( selFace->planepts[2], pFaceData->m_v3 );

radiant/surfacedialog.cpp

@@ -929,12 +929,8 @@ void SurfaceDlg::SetTexMods(){
 	}
 	GtkAdjustment *adjust = gtk_spin_button_get_adjustment( GTK_SPIN_BUTTON( spin ) );
 	adjust->step_increment = l_pIncrement->shift[0];
-	char buf[10]; // got into snprintf paranoia after BoundChecker detected a stack overrun
+	char buf[64]; // got into snprintf paranoia after BoundChecker detected a stack overrun
-#ifdef _WIN32
+	snprintf( buf, sizeof( buf ), "%g", l_pIncrement->shift[0] );
-	// TTimo: THIS IS UGLY
-#define snprintf _snprintf
-#endif
-	snprintf( buf, 10, "%g", l_pIncrement->shift[0] );
 	gtk_entry_set_text( GTK_ENTRY( GetDlgWidget( "hshift_inc" ) ), buf );
 
 	spin = GTK_SPIN_BUTTON( GetDlgWidget( "vshift" ) );
@@ -947,7 +943,7 @@ void SurfaceDlg::SetTexMods(){
 	}
 	adjust = gtk_spin_button_get_adjustment( GTK_SPIN_BUTTON( spin ) );
 	adjust->step_increment = l_pIncrement->shift[1];
-	snprintf( buf, 10, "%g", l_pIncrement->shift[1] );
+	snprintf( buf, sizeof( buf ), "%g", l_pIncrement->shift[1] );
 	gtk_entry_set_text( GTK_ENTRY( GetDlgWidget( "vshift_inc" ) ), buf );
 
 	spin = GTK_SPIN_BUTTON( GetDlgWidget( "hscale" ) );
@@ -956,7 +952,7 @@ void SurfaceDlg::SetTexMods(){
 
 	adjust = gtk_spin_button_get_adjustment( GTK_SPIN_BUTTON( spin ) );
 	adjust->step_increment = l_pIncrement->scale[0];
-	snprintf( buf, 10, "%g", l_pIncrement->scale[0] );
+	snprintf( buf, sizeof( buf ), "%g", l_pIncrement->scale[0] );
 	gtk_entry_set_text( GTK_ENTRY( GetDlgWidget( "hscale_inc" ) ), buf );
 
 	spin = GTK_SPIN_BUTTON( GetDlgWidget( "vscale" ) );
@@ -965,7 +961,7 @@ void SurfaceDlg::SetTexMods(){
 
 	adjust = gtk_spin_button_get_adjustment( GTK_SPIN_BUTTON( spin ) );
 	adjust->step_increment = l_pIncrement->scale[1];
-	snprintf( buf, 10, "%g", l_pIncrement->scale[1] );
+	snprintf( buf, sizeof( buf ), "%g", l_pIncrement->scale[1] );
 	gtk_entry_set_text( GTK_ENTRY( GetDlgWidget( "vscale_inc" ) ), buf );
 
 	//++timo compute BProtate as int ..
@@ -975,7 +971,7 @@ void SurfaceDlg::SetTexMods(){
 
 	adjust = gtk_spin_button_get_adjustment( GTK_SPIN_BUTTON( spin ) );
 	adjust->step_increment = l_pIncrement->rotate;
-	snprintf( buf, 10, "%g", l_pIncrement->rotate );
+	snprintf( buf, sizeof( buf ), "%g", l_pIncrement->rotate );
 	gtk_entry_set_text( GTK_ENTRY( GetDlgWidget( "rotate_inc" ) ), buf );
 
 	g_bListenChanged = true;
@@ -1036,7 +1032,7 @@ void SurfaceDlg::GetTexMods(){
 	else
 	{
 		strcpy( buffer, "textures/" );
-		strcpy( buffer + 9, text );
+		Q_strncpyz( buffer + 9, text, sizeof( buffer ) - 9 );
 		pt->SetName( buffer );
 	}
 

radiant/targetname.cpp

@@ -47,7 +47,7 @@ void Entity_Connect( entity_t *e1, entity_t *e2 ){
 			}
 		}
 	}
-	sprintf( newtarget, "t%i", maxtarget + 1 );
+	snprintf( newtarget, sizeof( newtarget ), "t%i", maxtarget + 1 );
 
 #ifdef _DEBUG
 	Sys_Printf( "Connecting entities with new target/targetname: %s\n", newtarget );

radiant/texwindow.cpp

@@ -494,7 +494,7 @@ void BuildShaderList(){
 	}
 
 	if ( g_pGameDescription->mGameFile != "hl.game" ) {
-		strcpy( filename, g_pGameDescription->mShaderlist.GetBuffer() );
+		Q_strncpyz( filename, g_pGameDescription->mShaderlist.GetBuffer(), sizeof( filename ) );
 		count = vfsGetFileCount( filename, 0 );
 		if ( count == 0 ) {
 			Sys_FPrintf( SYS_ERR, "Couldn't find '%s'\n", g_pGameDescription->mShaderlist.GetBuffer() );
@@ -603,7 +603,7 @@ void FillTextureMenu( GSList** pArray ){
 		char shaderfile[PATH_MAX];
 		gboolean found = FALSE;
 
-		ExtractFileName( (char*)l_shaderfiles->data, shaderfile );
+		ExtractFileName( (char*)l_shaderfiles->data, shaderfile, sizeof( shaderfile ) );
 		StripExtension( shaderfile );
 		strlwr( shaderfile );
 
@@ -749,7 +749,7 @@ void Texture_ShowDirectory(){
 
 	// need this function "GSList *lst SynapseServer::GetMinorList(char *major_name);"
 
-	sprintf( dirstring, "textures/%s", texture_directory );
+	snprintf( dirstring, sizeof( dirstring ), "textures/%s", texture_directory );
 	g_ImageManager.BeginExtensionsScan();
 	const char* ext;
 	while ( ( ext = g_ImageManager.GetNextExtension() ) != NULL )
@@ -759,7 +759,7 @@ void Texture_ShowDirectory(){
 
 	for ( temp = files; temp; temp = temp->next )
 	{
-		sprintf( name, "%s%s", texture_directory, (char*)temp->data );
+		snprintf( name, sizeof( name ), "%s%s", texture_directory, (char*)temp->data );
 
 		StripExtension( name );
 		strTemp = name;
@@ -792,7 +792,7 @@ void Texture_ShowDirectory(){
 
 		// build a texture name that fits the conventions for qtexture_t::name
 		char stdName[1024];
-		sprintf( stdName, "textures/%s", name );
+		snprintf( stdName, sizeof( stdName ), "textures/%s", name );
 		// check if this texture doesn't have a shader
 		if ( !QERApp_ActiveShader_ForTextureName( stdName ) ) {
 			QERApp_CreateShader_ForTextureName( stdName );
@@ -808,7 +808,7 @@ void Texture_ShowDirectory(){
 	// sort for displaying
 	QERApp_SortActiveShaders();
 
-	sprintf( name, "Textures: %s", texture_directory );
+	snprintf( name, sizeof( name ), "Textures: %s", texture_directory );
 	gtk_window_set_title( GTK_WINDOW( g_qeglobals_gui.d_entity ), name );
 
 	// select the first texture in the list
@@ -831,7 +831,7 @@ void Texture_ShowDirectory(){
    ==============
  */
 void Texture_ShowDirectory( int menunum ){
-	strcpy( texture_directory, texture_menunames[menunum - CMD_TEXTUREWAD] );
+	Q_strncpyz( texture_directory, texture_menunames[menunum - CMD_TEXTUREWAD], sizeof( texture_directory ) );
 	Texture_ShowDirectory();
 }
 
@@ -911,7 +911,7 @@ void Texture_ShowAll(){
 	QERApp_ActiveShaders_SetDisplayed( true );
 	g_bShowAllShaders = true;
 	// put some information in the texture window title?
-	sprintf( name, "Textures: in use" );
+	snprintf( name, sizeof( name ), "Textures: in use" );
 	gtk_window_set_title( GTK_WINDOW( g_qeglobals_gui.d_entity ), name );
 	Sys_UpdateWindows( W_TEXTURE );
 }
@@ -966,7 +966,7 @@ void WINAPI Texture_ShowInuse( void ){
 	// we are no longer showing everything
 	g_bShowAllShaders = false;
 	// put some information in the texture window title?
-	sprintf( name, "Textures: in use" );
+	snprintf( name, sizeof( name ), "Textures: in use" );
 	gtk_window_set_title( GTK_WINDOW( g_qeglobals_gui.d_entity ), name );
 
 
@@ -1000,7 +1000,7 @@ void Texture_ShowStartupShaders(){
 		int nLen;
 		GSList *shaderfiles = NULL;
 
-		strcpy( filename, g_pGameDescription->mShaderlist.GetBuffer() );
+		Q_strncpyz( filename, g_pGameDescription->mShaderlist.GetBuffer(), sizeof( filename ) );
 		count = vfsGetFileCount( filename, 0 );
 		if ( count == 0 ) {
 			Sys_FPrintf( SYS_ERR, "Couldn't find '%s'\n", g_pGameDescription->mShaderlist.GetBuffer() );
@@ -1023,7 +1023,7 @@ void Texture_ShowStartupShaders(){
 				bool found = false;
 
 				// each token should be a shader filename
-				sprintf( dirstring, "%s.shader", token );
+				snprintf( dirstring, sizeof( dirstring ), "%s.shader", token );
 
 				for ( tmp = shaderfiles; tmp != NULL; tmp = tmp->next )
 				{
@@ -1036,7 +1036,7 @@ void Texture_ShowStartupShaders(){
 
 				if ( !found ) {
 					shaderfiles = g_slist_append( l_shaderfiles, strdup( dirstring ) );
-					strcpy( texture_directory, dirstring );
+					Q_strncpyz( texture_directory, dirstring, sizeof( texture_directory ) );
 					Texture_ShowDirectory();
 					nLen++;
 				}

radiant/watchbsp.cpp

@@ -191,7 +191,7 @@ static void saxWarning( void *ctx, const char *msg, ... ){
 	va_list args;
 
 	va_start( args, msg );
-	vsprintf( saxMsgBuffer, msg, args );
+	vsnprintf( saxMsgBuffer, sizeof( saxMsgBuffer ), msg, args );
 	va_end( args );
 	Sys_FPrintf( SYS_WRN, "XML warning: %s\n", saxMsgBuffer );
 }
@@ -201,7 +201,7 @@ static void saxError( void *ctx, const char *msg, ... ){
 	va_list args;
 
 	va_start( args, msg );
-	vsprintf( saxMsgBuffer, msg, args );
+	vsnprintf( saxMsgBuffer, sizeof( saxMsgBuffer ), msg, args );
 	va_end( args );
 	Sys_FPrintf( SYS_ERR, "XML error: %s\n", saxMsgBuffer );
 }
@@ -212,7 +212,7 @@ static void saxFatal( void *ctx, const char *msg, ... ){
 	va_list args;
 
 	va_start( args, msg );
-	vsprintf( buffer, msg, args );
+	vsnprintf( buffer, sizeof( buffer ), msg, args );
 	va_end( args );
 	Sys_FPrintf( SYS_ERR, "XML fatal error: %s\n", buffer );
 }

radiant/xywindow.cpp

@@ -430,7 +430,7 @@ void CreateEntityFromName( const char* name, const vec3_t origin ){
 			if ( DoLightIntensityDlg( &intensity ) == IDOK ) {
 				g_PrefsDlg.m_iLastLightIntensity = intensity;
 				char buf[30];
-				sprintf( buf, "255 255 255 %d", intensity );
+				snprintf( buf, sizeof( buf ), "255 255 255 %d", intensity );
 				SetKeyValue( e, "_light", buf );
 			}
 		}
@@ -446,8 +446,8 @@ void CreateEntityFromName( const char* name, const vec3_t origin ){
 			//    prompt.GotoDlgCtrl( pWnd );
 			if ( DoLightIntensityDlg( &intensity ) == IDOK ) {
 				g_PrefsDlg.m_iLastLightIntensity = intensity;
-				char buf[10];
+				char buf[12];
-				sprintf( buf, "%d", intensity );
+				snprintf( buf, sizeof( buf ), "%d", intensity );
 				SetKeyValue( e, "light", buf );
 			}
 		}
@@ -2287,14 +2287,14 @@ void XYWnd::XY_DrawGrid(){
 		// This renders the numbers along varying X on top of the grid view (labels vertical grid lines).
 		for ( x = xb - ( (int) xb ) % stepx; x <= xe; x += stepx ) {
 			qglRasterPos2f( x + leftCushion, yPosLabelsTop );
-			sprintf( text, "%i", (int) x );
+			snprintf( text, sizeof( text ), "%i", (int) x );
 			gtk_glwidget_print_string( text );
 		}
 
 		// This renders the numbers along varying Y on the left of the grid view (labels horizontal grid lines).
 		for ( y = yb - ( (int) yb ) % stepy; y <= ye; y += stepy ) {
 			qglRasterPos2f( xPosLabelsLeft, y + bottomOffset );
-			sprintf( text, "%i", (int) y );
+			snprintf( text, sizeof( text ), "%i", (int) y );
 			gtk_glwidget_print_string( text );
 		}
 
@@ -2460,7 +2460,7 @@ void XYWnd::XY_DrawBlockGrid(){
 			for ( y = yb ; y < ye ; y += g_qeglobals.blockSize )
 			{
 				qglRasterPos2f( x + ( g_qeglobals.blockSize / 2 ), y + ( g_qeglobals.blockSize / 2 ) );
-				sprintf( text, "%i,%i",(int)floor( x / g_qeglobals.blockSize ), (int)floor( y / g_qeglobals.blockSize ) );
+				snprintf( text, sizeof( text ), "%i,%i",(int)floor( x / g_qeglobals.blockSize ), (int)floor( y / g_qeglobals.blockSize ) );
 				gtk_glwidget_print_string( text );
 			}
 	}

radiant/z.cpp

@@ -254,7 +254,7 @@ void Z_DrawGrid( void ){
 		for ( zz = zb ; zz < ze ; zz += step )
 		{
 			qglRasterPos2f( -w + ( 1 / z.scale ), zz );
-			sprintf( text, "%i",(int)zz );
+			snprintf( text, sizeof( text ), "%i",(int)zz );
 			gtk_glwidget_print_string( text );
 		}
 	}

tools/quake2/common/cmdlib.c

@@ -27,7 +27,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#ifdef WIN32
+#ifdef _WIN32
 #include <direct.h>
 #include <windows.h>
 #endif
@@ -93,7 +93,7 @@ char archivedir[1024];
 #define MAX_EX_ARGC 1024
 int ex_argc;
 char    *ex_argv[MAX_EX_ARGC];
-#ifdef WIN32
+#ifdef _WIN32
 #include "io.h"
 void ExpandWildcards( int *argc, char ***argv ){
 	struct _finddata_t fileinfo;
@@ -328,7 +328,7 @@ double I_FloatTime( void ){
 void Q_getwd( char *out ){
 	int i = 0;
 
-#ifdef WIN32
+#ifdef _WIN32
 	_getcwd( out, 256 );
 	strcat( out, "\\" );
 #else
@@ -347,7 +347,7 @@ void Q_getwd( char *out ){
 
 
 void Q_mkdir( const char *path ){
-#ifdef WIN32
+#ifdef _WIN32
 	if ( _mkdir( path ) != -1 ) {
 		return;
 	}
@@ -1128,7 +1128,7 @@ void    CreatePath( const char *path ){
 	char c;
 	char dir[1024];
 
-#ifdef WIN32
+#ifdef _WIN32
 	int olddrive = -1;
 
 	if ( path[1] == ':' ) {
@@ -1151,7 +1151,7 @@ void    CreatePath( const char *path ){
 		}
 	}
 
-#ifdef WIN32
+#ifdef _WIN32
 	if ( olddrive != -1 ) {
 		_chdrive( olddrive );
 	}
@@ -1177,7 +1177,7 @@ void QCopyFile( const char *from, const char *to ){
 }
 
 void Sys_Sleep( int n ){
-#ifdef WIN32
+#ifdef _WIN32
 	Sleep( n );
 #endif
 #if defined ( __linux__ ) || defined ( __APPLE__ )

tools/quake2/common/cmdlib.h

@@ -32,7 +32,7 @@
 #include <time.h>
 #include <stdarg.h>
 
-#ifdef WIN32
+#ifdef _WIN32
 	#ifdef NDEBUG                           // Don't show in a Release build
 		#pragma warning(disable : 4305)     // truncate from double to float
 		#pragma warning(disable : 4244)     // conversion from double to float
@@ -40,7 +40,7 @@
 	#endif
 #endif
 
-#ifdef WIN32
+#ifdef _WIN32
 	#pragma intrinsic( memset, memcpy )
 #endif
 

tools/quake2/common/inout.c

@@ -33,7 +33,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#ifdef WIN32
+#ifdef _WIN32
 #include <direct.h>
 #include <windows.h>
 #endif
@@ -46,7 +46,7 @@
 #endif
 #include "libxml/tree.h"
 
-#ifdef WIN32
+#ifdef _WIN32
 HWND hwndOut = NULL;
 qboolean lookedForServer = false;
 UINT wm_BroadcastCommand = -1;