From 486b1aa72217bbe683fce372c00417d498728ddb Mon Sep 17 00:00:00 2001 From: Eukara Date: Thu, 6 Dec 2018 05:51:24 +0000 Subject: [PATCH] Fixed a crash related to texture-names Added warning in case of a VIS-decompression overrun git-svn-id: https://svn.code.sf.net/p/fteqw/code/trunk@5358 fc73d0e0-1445-4013-8a0c-d673dee63da5 --- engine/common/q1bsp.c | 6 ++++++ engine/gl/gl_model.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/engine/common/q1bsp.c b/engine/common/q1bsp.c index c8737aa4a..41bbde0d9 100644 --- a/engine/common/q1bsp.c +++ b/engine/common/q1bsp.c @@ -1933,6 +1933,12 @@ static qbyte *Q1BSP_DecompressVis (qbyte *in, model_t *model, qbyte *decompresse c = in[1]; in += 2; + + if ((out - decompressed) + c > row) { + c = row - (out - decompressed); + Con_DPrintf ("warning: Vis decompression overrun\n"); + } + while (c) { *out++ = 0; diff --git a/engine/gl/gl_model.c b/engine/gl/gl_model.c index ec97ac2e5..921bb4426 100644 --- a/engine/gl/gl_model.c +++ b/engine/gl/gl_model.c @@ -3453,7 +3453,7 @@ TRACE(("dbg: Mod_LoadTextures: inittexturedescs\n")); tx = ZG_Malloc(&loadmodel->memgroup, sizeof(texture_t)); loadmodel->textures[i] = tx; - memcpy (tx->name, mt->name, sizeof(tx->name)); + Q_strncpyz(tx->name, mt->name, min(sizeof(mt->name)+1, sizeof(tx->name))); tx->width = mt->width; tx->height = mt->height;