From eec13dc1bfa1d794e7a0c7b3b59254f08a342e14 Mon Sep 17 00:00:00 2001 From: Jonathan Gray Date: Tue, 7 May 2013 17:41:16 +1000 Subject: [PATCH] buffer overflow and format string bug in auth server response processing from Ludwig Nussel in ioquake3 svn 1025 git 8ca8d845911fb6545bf723cade39944d874d01ea fix buffer overflow and format string bug in auth server response processing --- codemp/server/sv_client.cpp | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/codemp/server/sv_client.cpp b/codemp/server/sv_client.cpp index ba16372..d78e505 100644 --- a/codemp/server/sv_client.cpp +++ b/codemp/server/sv_client.cpp @@ -144,7 +144,6 @@ void SV_AuthorizeIpPacket( netadr_t from ) { int i; char *s; char *r; - char ret[1024]; if ( !NET_CompareBaseAdr( from, svs.authorizeAddress ) ) { Com_Printf( "SV_AuthorizeIpPacket: not from authorize server\n" ); @@ -190,8 +189,7 @@ void SV_AuthorizeIpPacket( netadr_t from ) { if (!r) { NET_OutOfBandPrint( NS_SERVER, svs.challenges[i].adr, "print\nAwaiting CD key authorization\n" ); } else { - sprintf(ret, "print\n%s\n", r); - NET_OutOfBandPrint( NS_SERVER, svs.challenges[i].adr, ret ); + NET_OutOfBandPrint( NS_SERVER, svs.challenges[i].adr, "print\n%s\n", r); } // clear the challenge record so it won't timeout and let them through Com_Memset( &svs.challenges[i], 0, sizeof( svs.challenges[i] ) ); @@ -202,8 +200,7 @@ void SV_AuthorizeIpPacket( netadr_t from ) { if (!r) { NET_OutOfBandPrint( NS_SERVER, svs.challenges[i].adr, "print\nSomeone is using this CD Key\n" ); } else { - sprintf(ret, "print\n%s\n", r); - NET_OutOfBandPrint( NS_SERVER, svs.challenges[i].adr, ret ); + NET_OutOfBandPrint( NS_SERVER, svs.challenges[i].adr, "print\n%s\n", r); } // clear the challenge record so it won't timeout and let them through