sprintf -> snprintf

vsprintf -> vsnprintf

source/cl_demo.c

@@ -411,7 +411,7 @@ void CL_Record_f (void)
 	if (cls.demorecording)
 		CL_Stop_f();
   
-	sprintf (name, "%s/%s", com_gamedir, Cmd_Argv(1));
+	snprintf (name, sizeof(name), "%s/%s", com_gamedir, Cmd_Argv(1));
 
 //
 // open the demo file
@@ -697,7 +697,7 @@ void CL_ReRecord_f (void)
 	if (cls.demorecording)
 		CL_Stop_f();
   
-	sprintf (name, "%s/%s", com_gamedir, Cmd_Argv(1));
+	snprintf (name, sizeof(name), "%s/%s", com_gamedir, Cmd_Argv(1));
 
 //
 // open the demo file

source/cl_main.c

@@ -231,7 +231,7 @@ void CL_SendConnectPacket (void)
 	//Info_SetValueForStarKey (cls.userinfo, "*ip", NET_AdrToString(adr), MAX_INFO_STRING);
 
 //	Con_Printf ("Connecting to %s...\n", cls.servername);
-	sprintf (data, "%c%c%c%cconnect %i %i %i \"%s\"\n",
+	snprintf (data, sizeof(data), "%c%c%c%cconnect %i %i %i \"%s\"\n",
 		255, 255, 255, 255,	PROTOCOL_VERSION, cls.qport, cls.challenge, cls.userinfo);
 	NET_SendPacket (strlen(data), data, adr);
 }
@@ -748,7 +748,7 @@ void CL_NextDemo (void)
 		}
 	}
 
-	sprintf (str,"playdemo %s\n", cls.demos[cls.demonum]);
+	snprintf (str, sizeof(str), "playdemo %s\n", cls.demos[cls.demonum]);
 	Cbuf_InsertText (str);
 	cls.demonum++;
 }
@@ -1021,7 +1021,7 @@ void CL_Download_f (void)
 		return;
 	}
 
-	sprintf (cls.downloadname, "%s/%s", com_gamedir, Cmd_Argv(1));
+	snprintf (cls.downloadname, sizeof(cls.downloadname), "%s/%s", com_gamedir, Cmd_Argv(1));
 
 	p = cls.downloadname;
 	for (;;) {
@@ -1034,7 +1034,7 @@ void CL_Download_f (void)
 			break;
 	}
 
-	strcpy(cls.downloadtempname, cls.downloadname);
+	strncpy (cls.downloadtempname, cls.downloadname, sizeof(cls.downloadtempname));
 	cls.download = fopen (cls.downloadname, "wb");
 	cls.downloadtype = dl_single;
 
@@ -1042,7 +1042,7 @@ void CL_Download_f (void)
 	SZ_Print (&cls.netchan.message, va("download %s\n",Cmd_Argv(1)));
 }
 
-#ifdef _WINDOWS
+#ifdef _WIN32
 #include <windows.h>
 /*
 =================
@@ -1188,7 +1188,7 @@ void CL_Init (void)
 //
 //  Windows commands
 //
-#ifdef _WINDOWS
+#ifdef _WIN32
 	Cmd_AddCommand ("windows", CL_Windows_f);
 #endif
 }
@@ -1206,8 +1206,8 @@ void Host_EndGame (char *message, ...)
 	va_list		argptr;
 	char		string[1024];
 	
-	va_start (argptr,message);
+	va_start (argptr, message);
-	vsprintf (string,message,argptr);
+	vsnprintf (string, sizeof(string), message, argptr);
 	va_end (argptr);
 	Con_Printf ("\n===========================\n");
 	Con_Printf ("Host_EndGame: %s\n",string);
@@ -1236,7 +1236,7 @@ void Host_Error (char *error, ...)
 	inerror = true;
 	
 	va_start (argptr,error);
-	vsprintf (string,error,argptr);
+	vsnprintf (string, sizeof(string), error, argptr);
 	va_end (argptr);
 	Con_Printf ("Host_Error: %s\n",string);
 	

source/cl_misc.c

@@ -33,8 +33,8 @@ void SV_Error (char *error, ...)
 	va_list		argptr;
 	static	char		string[1024];
 
-	va_start (argptr,error);
+	va_start (argptr, error);
-	vsprintf (string,error,argptr);
+	vsnprintf (string, sizeof(string), error, argptr);
 	va_end (argptr);
 
 	Sys_Error ("%s\n",string);

source/cl_parse.c

@@ -375,9 +375,9 @@ void CL_ParseDownload (void)
 	if (!cls.download)
 	{
 		if (strncmp(cls.downloadtempname,"skins/",6))
-			sprintf (name, "%s/%s", com_gamedir, cls.downloadtempname);
+			snprintf (name, sizeof(name), "%s/%s", com_gamedir, cls.downloadtempname);
 		else
-			sprintf (name, "qw/%s", cls.downloadtempname);
+			snprintf (name, sizeof(name), "qw/%s", cls.downloadtempname);
 
 		COM_CreatePath (name);
 
@@ -425,11 +425,11 @@ void CL_ParseDownload (void)
 		// rename the temp file to it's final name
 		if (strcmp(cls.downloadtempname, cls.downloadname)) {
 			if (strncmp(cls.downloadtempname,"skins/",6)) {
-				sprintf (oldn, "%s/%s", com_gamedir, cls.downloadtempname);
+				snprintf (oldn, sizeof(oldn), "%s/%s", com_gamedir, cls.downloadtempname);
-				sprintf (newn, "%s/%s", com_gamedir, cls.downloadname);
+				snprintf (newn, sizeof(newn), "%s/%s", com_gamedir, cls.downloadname);
 			} else {
-				sprintf (oldn, "qw/%s", cls.downloadtempname);
+				snprintf (oldn, sizeof(oldn), "qw/%s", cls.downloadtempname);
-				sprintf (newn, "qw/%s", cls.downloadname);
+				snprintf (newn, sizeof(newn), "qw/%s", cls.downloadname);
 			}
 			r = rename (oldn, newn);
 			if (r)
@@ -570,7 +570,7 @@ void CL_ParseServerData (void)
 	//ZOID--run the autoexec.cfg in the gamedir
 	//if it exists
 	if (cflag) {
-		sprintf(fn, "%s/%s", com_gamedir, "config.cfg");
+		snprintf (fn, sizeof(fn), "%s/%s", com_gamedir, "config.cfg");
 		if ((f = fopen(fn, "r")) != NULL) {
 			fclose(f);
 			Cbuf_AddText ("cl_warncmd 0\n");

source/cl_pred.c

@@ -156,7 +156,7 @@ void CL_PredictMove (void)
 		char		text[1024];
 
 		cls.state = ca_active;
-		sprintf (text, "QuakeForge: %s", cls.servername);
+		snprintf (text, sizeof(text), "QuakeForge: %s", cls.servername);
 #ifdef _WIN32
 		SetWindowText (mainwindow, text);
 #endif

source/cl_sys_win.c

@@ -93,12 +93,12 @@ void Sys_DebugLog(char *file, char *fmt, ...)
     static char data[1024];
     int fd;
     
-    va_start(argptr, fmt);
+    va_start (argptr, fmt);
-    vsprintf(data, fmt, argptr);
+    vsnprintf (data, sizeof(data), fmt, argptr);
-    va_end(argptr);
+    va_end (argptr);
-    fd = open(file, O_WRONLY | O_CREAT | O_APPEND, 0666);
+    fd = open (file, O_WRONLY | O_CREAT | O_APPEND, 0666);
-    write(fd, data, strlen(data));
+    write (fd, data, strlen(data));
-    close(fd);
+    close (fd);
 };
 
 /*
@@ -237,7 +237,7 @@ void Sys_Error (char *error, ...)
 	Host_Shutdown ();
 
 	va_start (argptr, error);
-	vsprintf (text, error, argptr);
+	vsnprintf (text, sizeof(text), error, argptr);
 	va_end (argptr);
 
 	MessageBox(NULL, text, "Error", 0 /* MB_OK */ );

source/common.c

@@ -1216,7 +1216,7 @@ char	*va(char *format, ...)
 	static char		string[1024];
 	
 	va_start (argptr, format);
-	vsprintf (string, format,argptr);
+	vsnprintf (string, sizeof(string), format, argptr);
 	va_end (argptr);
 
 	return string;	
@@ -1361,7 +1361,7 @@ void COM_WriteFile (char *filename, void *data, int len)
 	FILE	*f;
 	char	name[MAX_OSPATH];
 	
-	sprintf (name, "%s/%s", com_gamedir, filename);
+	snprintf (name, sizeof(name), "%s/%s", com_gamedir, filename);
 	
 	f = fopen (name, "wb");
 	if (!f) {
@@ -1489,7 +1489,7 @@ int COM_FOpenFile (char *filename, FILE **file)
 					continue;
 			}
 			
-			sprintf (netpath, "%s/%s",search->filename, filename);
+			snprintf (netpath, sizeof(netpath), "%s/%s", search->filename, filename);
 			
 			findtime = Sys_FileTime (netpath);
 			if (findtime == -1)
@@ -1703,7 +1703,7 @@ void COM_AddGameDirectory (char *dir)
 //
 	for (i=0 ; ; i++)
 	{
-		sprintf (pakfile, "%s/pak%i.pak", dir, i);
+		snprintf (pakfile, sizeof(pakfile), "%s/pak%i.pak", dir, i);
 		pak = COM_LoadPackFile (pakfile);
 		if (!pak)
 			break;
@@ -1764,7 +1764,7 @@ void COM_Gamedir (char *dir)
 	if (!strcmp(dir,"id1") || !strcmp(dir, "qw"))
 		return;
 
-	sprintf (com_gamedir, "%s/%s", com_basedir, dir);
+	snprintf (com_gamedir, sizeof(com_gamedir), "%s/%s", com_basedir, dir);
 
 	//
 	// add the directory to the search path
@@ -1779,7 +1779,7 @@ void COM_Gamedir (char *dir)
 	//
 	for (i=0 ; ; i++)
 	{
-		sprintf (pakfile, "%s/pak%i.pak", com_gamedir, i);
+		snprintf (pakfile, sizeof(pakfile), "%s/pak%i.pak", com_gamedir, i);
 		pak = COM_LoadPackFile (pakfile);
 		if (!pak)
 			break;
@@ -1975,7 +1975,7 @@ void Info_RemovePrefixedKeys (char *start, char prefix)
 
 void Info_SetValueForStarKey (char *s, char *key, char *value, int maxsize)
 {
-	char	new[1024], *v;
+	char	newstr[1024], *v;
 	int		c, is_name, is_team;
 
 	if (strstr (key, "\\") || strstr (value, "\\") )
@@ -2009,9 +2009,9 @@ void Info_SetValueForStarKey (char *s, char *key, char *value, int maxsize)
 	if (!value || !strlen(value))
 		return;
 
-	sprintf (new, "\\%s\\%s", key, value);
+	snprintf (newstr, sizeof(newstr), "\\%s\\%s", key, value);
 
-	if ((int)(strlen(new) + strlen(s)) > maxsize)
+	if ((int)(strlen(newstr) + strlen(s)) > maxsize)
 	{
 		Con_Printf ("Info string length exceeded\n");
 		return;
@@ -2019,7 +2019,7 @@ void Info_SetValueForStarKey (char *s, char *key, char *value, int maxsize)
 
 	// only copy ascii values
 	s += strlen(s);
-	v = new;
+	v = newstr;
 	is_name = stricmp(key, "name") == 0;
 	is_team = stricmp(key, "team") == 0;
 	while (*v)

source/console.c

@@ -357,15 +357,15 @@ Handles cursor positioning, line wrapping, etc
 ================
 */
 #define	MAXPRINTMSG	4096
-// FIXME: make a buffer size safe vsprintf?
+
 void Con_Printf (char *fmt, ...)
 {
 	va_list		argptr;
 	char		msg[MAXPRINTMSG];
 	static qboolean	inupdate;
 	
-	va_start (argptr,fmt);
+	va_start (argptr, fmt);
-	vsprintf (msg,fmt,argptr);
+	vsnprintf (msg, sizeof(msg), fmt, argptr);
 	va_end (argptr);
 	
 // also echo to debugging console
@@ -410,8 +410,8 @@ void Con_DPrintf (char *fmt, ...)
 	if (!developer.value)
 		return;			// don't confuse non-developers with techie stuff...
 
-	va_start (argptr,fmt);
+	va_start (argptr, fmt);
-	vsprintf (msg,fmt,argptr);
+	vsnprintf (msg, sizeof(msg), fmt, argptr);
 	va_end (argptr);
 	
 	Con_Printf ("%s", msg);
@@ -689,8 +689,8 @@ void Con_SafePrintf (char *fmt, ...)
 	char		msg[1024];
 	int			temp;
 		
-	va_start (argptr,fmt);
+	va_start (argptr, fmt);
-	vsprintf (msg,fmt,argptr);
+	vsnprintf (msg, sizeof(msg), fmt, argptr);
 	va_end (argptr);
 	
 	temp = scr_disabled_for_loading;

source/gl_mesh.c

@@ -51,6 +51,12 @@
 #include "console.h"
 #include "glquake.h"
 
+// FIXME: include quakedef.h instead
+#ifdef _WIN32
+#define snprintf _snprintf
+#define vsnprintf _vsnprintf
+#endif
+
 /*
 =================================================================
 
@@ -350,12 +356,12 @@ void GL_MakeAliasModelDisplayLists (model_t *m, aliashdr_t *hdr)
 		//
 		// save out the cached version
 		//
-		sprintf (fullpath, "%s/%s", com_gamedir, cache);
+		snprintf (fullpath, sizeof(fullpath), "%s/%s", com_gamedir, cache);
 		f = fopen (fullpath, "wb");
 		if (!f) {
 			char gldir[MAX_OSPATH];
 
-			sprintf (gldir, "%s/glquake", com_gamedir);
+			snprintf (gldir, sizeof(gldir), "%s/glquake", com_gamedir);
 			Sys_mkdir (gldir);
 			f = fopen (fullpath, "wb");
 		}

source/gl_model.c

@@ -56,6 +56,12 @@
 #include "console.h"
 #include "glquake.h"
 
+// FIXME: include quakedef.h instead
+#ifdef _WIN32
+#define snprintf _snprintf
+#define vsnprintf _vsnprintf
+#endif
+
 void SV_Error (char *error, ...);
 
 extern char	loadname[];	// for hunk tags
@@ -331,7 +337,7 @@ void *Mod_LoadAllSkins (int numskins, daliasskintype_t *pskintype)
 					SV_Error ("Player skin too large");
 				memcpy (player_8bit_texels, (byte *)(pskintype + 1), s);
 			}
-			sprintf (name, "%s_%i", loadmodel->name, i);
+			snprintf (name, sizeof(name), "%s_%i", loadmodel->name, i);
 			pheader->gl_texturenum[i][0] =
 			pheader->gl_texturenum[i][1] =
 			pheader->gl_texturenum[i][2] =
@@ -351,7 +357,7 @@ void *Mod_LoadAllSkins (int numskins, daliasskintype_t *pskintype)
 			for (j=0 ; j<groupskins ; j++)
 			{
 					Mod_FloodFillSkin( skin, pheader->skinwidth, pheader->skinheight );
-					sprintf (name, "%s_%i_%i", loadmodel->name, i,j);
+					snprintf (name, sizeof(name), "%s_%i_%i", loadmodel->name, i,j);
 					pheader->gl_texturenum[i][j&3] = 
 						GL_LoadTexture (name, pheader->skinwidth, 
 						pheader->skinheight, (byte *)(pskintype), true, false);
@@ -405,7 +411,7 @@ void Mod_LoadAliasModel (model_t *mod, void *buffer)
 
 		if (cls.state >= ca_connected) {
 			MSG_WriteByte (&cls.netchan.message, clc_stringcmd);
-			sprintf(st, "setinfo %s %d", 
+			snprintf(st, sizeof(st), "setinfo %s %d", 
 				!strcmp(loadmodel->name, "progs/player.mdl") ? pmodel_name : emodel_name,
 				(int)crc);
 			SZ_Print (&cls.netchan.message, st);
@@ -595,7 +601,7 @@ void * Mod_LoadSpriteFrame (void * pin, mspriteframe_t **ppframe, int framenum)
 	pspriteframe->left = origin[0];
 	pspriteframe->right = width + origin[0];
 
-	sprintf (name, "%s_%i", loadmodel->name, framenum);
+	snprintf (name, sizeof(name), "%s_%i", loadmodel->name, framenum);
 	pspriteframe->gl_texturenum = GL_LoadTexture (name, width, height, (byte *)(pinframe + 1), true, true);
 
 	return (void *)((byte *)pinframe + sizeof (dspriteframe_t) + size);

source/gl_screen.c

@@ -58,6 +58,12 @@
 #include "console.h"
 #include "glquake.h"
 
+// FIXME: include quakedef.h instead
+#ifdef _WIN32
+#define snprintf _snprintf
+#define vsnprintf _vsnprintf
+#endif
+
 /*
 
 background clear
@@ -673,7 +679,7 @@ void SCR_ScreenShot_f (void)
 	{ 
 		pcxname[5] = i/10 + '0'; 
 		pcxname[6] = i%10 + '0'; 
-		sprintf (checkname, "%s/%s", com_gamedir, pcxname);
+		snprintf (checkname, sizeof(checkname), "%s/%s", com_gamedir, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;  // file doesn't exist
 	} 
@@ -896,7 +902,7 @@ void SCR_RSShot_f (void)
 	{ 
 		pcxname[6] = i/10 + '0'; 
 		pcxname[7] = i%10 + '0'; 
-		sprintf (checkname, "%s/%s", com_gamedir, pcxname);
+		snprintf (checkname, sizeof(checkname), "%s/%s", com_gamedir, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;	// file doesn't exist
 	} 

source/gl_vidlinux.c

@@ -285,9 +285,9 @@ void	VID_SetPalette (unsigned char *palette)
 			}
 			d_15to8table[i]=k;
 		}
-		sprintf(s, "%s/glquake", com_gamedir);
+		snprintf (s, sizeof(s), "%s/glquake", com_gamedir);
  		Sys_mkdir (s);
-		sprintf(s, "%s/glquake/15to8.pal", com_gamedir);
+		snprintf (s, sizeof(s), "%s/glquake/15to8.pal", com_gamedir);
 		if ((f = fopen(s, "wb")) != NULL) {
 			fwrite(d_15to8table, 1<<15, 1, f);
 			fclose(f);
@@ -640,7 +640,7 @@ void VID_Init(unsigned char *palette)
 
 	GL_Init();
 
-	sprintf (gldir, "%s/glquake", com_gamedir);
+	snprintf (gldir, sizeof(gldir), "%s/glquake", com_gamedir);
 	Sys_mkdir (gldir);
 
 	VID_SetPalette(palette);

source/gl_vidlinux_svga.c

@@ -315,9 +315,9 @@ void	VID_SetPalette (unsigned char *palette)
 			}
 			d_15to8table[i]=k;
 		}
-		sprintf(s, "%s/glquake", com_gamedir);
+		snprintf (s, sizeof(s), "%s/glquake", com_gamedir);
  		Sys_mkdir (s);
-		sprintf(s, "%s/glquake/15to8.pal", com_gamedir);
+		snprintf (s, sizeof(s), "%s/glquake/15to8.pal", com_gamedir);
 		if ((f = fopen(s, "wb")) != NULL) {
 			fwrite(d_15to8table, 1<<15, 1, f);
 			fclose(f);
@@ -678,7 +678,7 @@ void VID_Init(unsigned char *palette)
 
 	GL_Init();
 
-	sprintf (gldir, "%s/glquake", com_gamedir);
+	snprintf (gldir, sizeof(gldir), "%s/glquake", com_gamedir);
 	Sys_mkdir (gldir);
 
 	VID_SetPalette(palette);

source/gl_vidlinux_x11.c

@@ -509,9 +509,9 @@ void	VID_SetPalette (unsigned char *palette)
 			}
 			d_15to8table[i]=k;
 		}
-		sprintf(s, "%s/glquake", com_gamedir);
+		snprintf (s, sizeof(s), "%s/glquake", com_gamedir);
  		Sys_mkdir (s);
-		sprintf(s, "%s/glquake/15to8.pal", com_gamedir);
+		snprintf(s, sizeof(s), "%s/glquake/15to8.pal", com_gamedir);
 		if ((f = fopen(s, "wb")) != NULL) {
 			fwrite(d_15to8table, 1<<15, 1, f);
 			fclose(f);
@@ -762,7 +762,7 @@ void VID_Init(unsigned char *palette)
 
 	GL_Init();
 
-	sprintf (gldir, "%s/glquake", com_gamedir);
+	snprintf (gldir, sizeof(gldir), "%s/glquake", com_gamedir);
 	Sys_mkdir (gldir);
 
 	VID_SetPalette(palette);

source/gl_vidnt.c

@@ -1196,7 +1196,7 @@ char *VID_GetModeDescription (int mode)
 	}
 	else
 	{
-		sprintf (temp, "Desktop resolution (%dx%d)",
+		snprintf (temp, sizeof(temp), "Desktop resolution (%dx%d)",
 				 modelist[MODE_FULLSCREEN_DEFAULT].width,
 				 modelist[MODE_FULLSCREEN_DEFAULT].height);
 		pinfo = temp;
@@ -1221,11 +1221,11 @@ char *VID_GetExtModeDescription (int mode)
 	{
 		if (!leavecurrentmode)
 		{
-			sprintf(pinfo,"%s fullscreen", pv->modedesc);
+			snprintf (pinfo, sizeof(pinfo), "%s fullscreen", pv->modedesc);
 		}
 		else
 		{
-			sprintf (pinfo, "Desktop resolution (%dx%d)",
+			snprintf (pinfo, sizeof(pinfo), "Desktop resolution (%dx%d)",
 					 modelist[MODE_FULLSCREEN_DEFAULT].width,
 					 modelist[MODE_FULLSCREEN_DEFAULT].height);
 		}
@@ -1233,9 +1233,9 @@ char *VID_GetExtModeDescription (int mode)
 	else
 	{
 		if (modestate == MS_WINDOWED)
-			sprintf(pinfo, "%s windowed", pv->modedesc);
+			snprintf (pinfo, sizeof(pinfo), "%s windowed", pv->modedesc);
 		else
-			sprintf(pinfo, "windowed");
+			strcpy (pinfo, "windowed");
 	}
 
 	return pinfo;
@@ -1822,7 +1822,7 @@ void	VID_Init (unsigned char *palette)
 
 	GL_Init ();
 
-	sprintf (gldir, "%s/glquake", com_gamedir);
+	snprintf (gldir, sizeof(gldir), "%s/glquake", com_gamedir);
 	Sys_mkdir (gldir);
 
 	vid_realmode = vid_modenum;

source/net_chan.c

@@ -160,7 +160,7 @@ void Netchan_OutOfBandPrint (netadr_t adr, char *format, ...)
 	static char		string[8192];		// ??? why static?
 	
 	va_start (argptr, format);
-	vsprintf (string, format,argptr);
+	vsnprintf (string, sizeof(string), format, argptr);
 	va_end (argptr);
 
 

source/pr_edict.c

@@ -290,21 +290,21 @@ char *PR_ValueString (etype_t type, eval_t *val)
 	switch (type)
 	{
 	case ev_string:
-		sprintf (line, "%s", PR_GetString(val->string));
+		snprintf (line, sizeof(line), "%s", PR_GetString(val->string));
 		break;
 	case ev_entity:	
 		sprintf (line, "entity %i", NUM_FOR_EDICT(PROG_TO_EDICT(val->edict)) );
 		break;
 	case ev_function:
 		f = pr_functions + val->function;
-		sprintf (line, "%s()", PR_GetString(f->s_name));
+		snprintf (line, sizeof(line), "%s()", PR_GetString(f->s_name));
 		break;
 	case ev_field:
 		def = ED_FieldAtOfs ( val->_int );
-		sprintf (line, ".%s", PR_GetString(def->s_name));
+		snprintf (line, sizeof(line), ".%s", PR_GetString(def->s_name));
 		break;
 	case ev_void:
-		sprintf (line, "void");
+		strcpy (line, "void");
 		break;
 	case ev_float:
 		sprintf (line, "%5.1f", val->_float);
@@ -313,7 +313,7 @@ char *PR_ValueString (etype_t type, eval_t *val)
 		sprintf (line, "'%5.1f %5.1f %5.1f'", val->vector[0], val->vector[1], val->vector[2]);
 		break;
 	case ev_pointer:
-		sprintf (line, "pointer");
+		strcpy (line, "pointer");
 		break;
 	default:
 		sprintf (line, "bad type %i", type);
@@ -342,21 +342,21 @@ char *PR_UglyValueString (etype_t type, eval_t *val)
 	switch (type)
 	{
 	case ev_string:
-		sprintf (line, "%s", PR_GetString(val->string));
+		snprintf (line, sizeof(line), "%s", PR_GetString(val->string));
 		break;
 	case ev_entity:	
 		sprintf (line, "%i", NUM_FOR_EDICT(PROG_TO_EDICT(val->edict)));
 		break;
 	case ev_function:
 		f = pr_functions + val->function;
-		sprintf (line, "%s", PR_GetString(f->s_name));
+		snprintf (line, sizeof(line), "%s", PR_GetString(f->s_name));
 		break;
 	case ev_field:
 		def = ED_FieldAtOfs ( val->_int );
-		sprintf (line, "%s", PR_GetString(def->s_name));
+		snprintf (line, sizeof(line), "%s", PR_GetString(def->s_name));
 		break;
 	case ev_void:
-		sprintf (line, "void");
+		strcpy (line, "void");
 		break;
 	case ev_float:
 		sprintf (line, "%f", val->_float);
@@ -395,7 +395,7 @@ char *PR_GlobalString (int ofs)
 	else
 	{
 		s = PR_ValueString (def->type, val);
-		sprintf (line,"%i(%s)%s", ofs, PR_GetString(def->s_name), s);
+		snprintf (line, sizeof(line), "%i(%s)%s", ofs, PR_GetString(def->s_name), s);
 	}
 	
 	i = strlen(line);

source/pr_exec.c

@@ -271,8 +271,8 @@ void PR_RunError (char *error, ...)
 	va_list		argptr;
 	char		string[1024];
 
-	va_start (argptr,error);
+	va_start (argptr, error);
-	vsprintf (string,error,argptr);
+	vsnprintf (string, sizeof(string), error,argptr);
 	va_end (argptr);
 
 	PR_PrintStatement (pr_statements + pr_xstatement);
@@ -288,7 +288,7 @@ void PR_RunError (char *error, ...)
 ============================================================================
 PR_ExecuteProgram
 
-The interpretation main loop
+The interpretation main loop                                                            /*
 ============================================================================
 */
 

source/screen.c

@@ -680,7 +680,7 @@ void SCR_ScreenShot_f (void)
 	{ 
 		pcxname[5] = i/10 + '0'; 
 		pcxname[6] = i%10 + '0'; 
-		sprintf (checkname, "%s/%s", com_gamedir, pcxname);
+		snprintf (checkname, sizeof(checkname), "%s/%s", com_gamedir, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;	// file doesn't exist
 	} 
@@ -826,7 +826,7 @@ void SCR_RSShot_f (void)
 	{ 
 		pcxname[6] = i/10 + '0'; 
 		pcxname[7] = i%10 + '0'; 
-		sprintf (checkname, "%s/%s", com_gamedir, pcxname);
+		snprintf (checkname, sizeof(checkname), "%s/%s", com_gamedir, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;	// file doesn't exist
 	} 

source/skin.c

@@ -126,12 +126,12 @@ byte	*Skin_Cache (skin_t *skin)
 //
 // load the pic from disk
 //
-	sprintf (name, "skins/%s.pcx", skin->name);
+	snprintf (name, sizeof(name), "skins/%s.pcx", skin->name);
 	raw = COM_LoadTempFile (name);
 	if (!raw)
 	{
 		Con_Printf ("Couldn't load skin %s\n", name);
-		sprintf (name, "skins/%s.pcx", baseskin.string);
+		snprintf (name, sizeof(name), "skins/%s.pcx", baseskin.string);
 		raw = COM_LoadTempFile (name);
 		if (!raw)
 		{

source/sv_ccmds.c

@@ -112,7 +112,7 @@ void SV_Logfile_f (void)
 		return;
 	}
 
-	sprintf (name, "%s/qconsole.log", com_gamedir);
+	snprintf (name, sizeof(name), "%s/qconsole.log", com_gamedir);
 	Con_Printf ("Logging text to %s.\n", name);
 	sv_logfile = fopen (name, "w");
 	if (!sv_logfile)
@@ -141,7 +141,7 @@ void SV_Fraglogfile_f (void)
 	// find an unused name
 	for (i=0 ; i<1000 ; i++)
 	{
-		sprintf (name, "%s/frag_%i.log", com_gamedir, i);
+		snprintf (name, sizeof(name), "%s/frag_%i.log", com_gamedir, i);
 		sv_fraglogfile = fopen (name, "r");
 		if (!sv_fraglogfile)
 		{	// can't read it, so create this one
@@ -321,7 +321,7 @@ void SV_Map_f (void)
 	strcpy (level, Cmd_Argv(1));
 
 	// check to make sure the level exists
-	sprintf (expanded, "maps/%s.bsp", level);
+	snprintf (expanded, sizeof(expanded), "maps/%s.bsp", level);
 	COM_FOpenFile (expanded, &f);
 	if (!f)
 	{
@@ -724,7 +724,7 @@ void SV_Floodprotmsg_f (void)
 		Con_Printf("Usage: floodprotmsg \"<message>\"\n");
 		return;
 	}
-	sprintf(fp_msg, "%s", Cmd_Argv(1));
+	snprintf (fp_msg, sizeof(fp_msg), "%s", Cmd_Argv(1));
 }
   
 /*
@@ -790,7 +790,7 @@ void SV_Snap (int uid)
 
 	sprintf(pcxname, "%d-00.pcx", uid);
 
-	sprintf(checkname, "%s/snap", gamedirfile);
+	snprintf (checkname, sizeof(checkname), "%s/snap", gamedirfile);
 	Sys_mkdir(gamedirfile);
 	Sys_mkdir(checkname);
 		
@@ -798,7 +798,7 @@ void SV_Snap (int uid)
 	{ 
 		pcxname[strlen(pcxname) - 6] = i/10 + '0'; 
 		pcxname[strlen(pcxname) - 5] = i%10 + '0'; 
-		sprintf (checkname, "%s/snap/%s", gamedirfile, pcxname);
+		snprintf (checkname, sizeof(checkname), "%s/snap/%s", gamedirfile, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;	// file doesn't exist
 	} 

source/sv_init.c

@@ -344,8 +344,8 @@ void SV_SpawnServer (char *server)
 
 	sv.time = 1.0;
 	
-	strcpy (sv.name, server);
+	strncpy (sv.name, server, sizeof(sv.name));
-	sprintf (sv.modelname,"maps/%s.bsp", server);
+	snprintf (sv.modelname, sizeof(sv.modelname), "maps/%s.bsp", server);
 	sv.worldmodel = Mod_ForName (sv.modelname, true);
 	SV_CalcPHS ();
 

source/sv_main.c

@@ -140,8 +140,8 @@ void SV_Error (char *error, ...)
 
 	inerror = true;
 
-	va_start (argptr,error);
+	va_start (argptr, error);
-	vsprintf (string,error,argptr);
+	vsnprintf (string, sizeof(string), error, argptr);
 	va_end (argptr);
 
 	Con_Printf ("SV_Error: %s\n",string);
@@ -307,7 +307,7 @@ void SV_FullClientUpdate (client_t *client, sizebuf_t *buf)
 	MSG_WriteByte (buf, i);
 	MSG_WriteFloat (buf, realtime - client->connection_started);
 
-	strcpy (info, client->userinfo);
+	strncpy (info, client->userinfo, sizeof(info));
 	Info_RemovePrefixedKeys (info, '_');	// server passwords, etc
 
 	MSG_WriteByte (buf, svc_updateuserinfo);
@@ -436,8 +436,11 @@ void SVC_Log (void)
 
 	Con_DPrintf ("sending log %i to %s\n", svs.logsequence-1, NET_AdrToString(net_from));
 
-	sprintf (data, "stdlog %i\n", svs.logsequence-1);
+	//sprintf (data, "stdlog %i\n", svs.logsequence-1);
-	strcat (data, (char *)svs.log_buf[((svs.logsequence-1)&1)]);
+	//strcat (data, (char *)svs.log_buf[((svs.logsequence-1)&1)]);
+	snprintf (data, sizeof(data), "stdlog %i\n%s", 
+            svs.logsequence-1, 
+            (char *)svs.log_buf[((svs.logsequence-1)&1)]);
 
 	NET_SendPacket (strlen(data)+1, data, net_from);
 }
@@ -719,6 +722,12 @@ void SVC_DirectConnect (void)
 	else
 		Con_DPrintf ("Client %s connected\n", newcl->name);
 	newcl->sendinfo = true;
+
+    // QuakeForge stuff.
+    newcl->msecs = 0;
+    newcl->msec_cheating = 0;
+    newcl->last_check = realtime;
+
 }
 
 int Rcon_Validate (void)
@@ -1012,7 +1021,7 @@ void SV_WriteIP_f (void)
 	byte	b[4];
 	int		i;
 
-	sprintf (name, "%s/listip.cfg", com_gamedir);
+	snprintf (name, sizeof(name), "%s/listip.cfg", com_gamedir);
 
 	Con_Printf ("Writing %s.\n", name);
 
@@ -1379,7 +1388,7 @@ void SV_InitLocal (void)
 	Cmd_AddCommand ("writeip", SV_WriteIP_f);
 
 	for (i=0 ; i<MAX_MODELS ; i++)
-		sprintf (localmodels[i], "*%i", i);
+		snprintf (localmodels[i], sizeof(localmodels[i]), "*%i", i);
 
 	Info_SetValueForStarKey (svs.info, "*version", QW_VERSION,
 			MAX_SERVERINFO_STRING);
@@ -1436,7 +1445,7 @@ void Master_Heartbeat (void)
 			active++;
 
 	svs.heartbeat_sequence++;
-	sprintf (string, "%c\n%i\n%i\n", S2M_HEARTBEAT,
+	snprintf (string, sizeof(string), "%c\n%i\n%i\n", S2M_HEARTBEAT,
 		svs.heartbeat_sequence, active);
 
 
@@ -1461,7 +1470,7 @@ void Master_Shutdown (void)
 	char		string[2048];
 	int			i;
 
-	sprintf (string, "%c\n", S2M_SHUTDOWN);
+	snprintf (string, sizeof(string), "%c\n", S2M_SHUTDOWN);
 
 	// send to group master
 	for (i=0 ; i<MAX_MASTERS ; i++)
@@ -1545,7 +1554,7 @@ void SV_ExtractFromUserinfo (client_t *cl)
 					p = val + 4;
 			}
 
-			sprintf(newname, "(%d)%-.40s", dupc++, p);
+			snprintf(newname, sizeof(newname), "(%d)%-.40s", dupc++, p);
 			Info_SetValueForKey (cl->userinfo, "name", newname, MAX_INFO_STRING);
 			val = Info_ValueForKey (cl->userinfo, "name");
 		} else
@@ -1631,8 +1640,8 @@ SV_Init
 void SV_Init (quakeparms_t *parms)
 {
 	COM_InitArgv (parms->argc, parms->argv);
-	COM_AddParm ("-game");
+	//COM_AddParm ("-game");
-	COM_AddParm ("qw");
+	//COM_AddParm ("qw");
 
 	if (COM_CheckParm ("-minmemory"))
 		parms->memsize = MINIMUM_MEMORY;

source/sv_send.c

@@ -109,14 +109,14 @@ Handles cursor positioning, line wrapping, etc
 ================
 */
 #define	MAXPRINTMSG	4096
-// FIXME: make a buffer size safe vsprintf?
+
 void Con_Printf (char *fmt, ...)
 {
 	va_list		argptr;
 	char		msg[MAXPRINTMSG];
 	
-	va_start (argptr,fmt);
+	va_start (argptr, fmt);
-	vsprintf (msg,fmt,argptr);
+	vsnprintf (msg, sizeof(msg), fmt, argptr);
 	va_end (argptr);
 
 	// add to redirected message
@@ -148,8 +148,8 @@ void Con_DPrintf (char *fmt, ...)
 	if (!developer.value)
 		return;
 
-	va_start (argptr,fmt);
+	va_start (argptr, fmt);
-	vsprintf (msg,fmt,argptr);
+	vsnprintf (msg, sizeof(msg), fmt, argptr);
 	va_end (argptr);
 	
 	Con_Printf ("%s", msg);
@@ -186,8 +186,8 @@ void SV_ClientPrintf (client_t *cl, int level, char *fmt, ...)
 	if (level < cl->messagelevel)
 		return;
 	
-	va_start (argptr,fmt);
+	va_start (argptr, fmt);
-	vsprintf (string, fmt,argptr);
+	vsnprintf (string, sizeof(string), fmt, argptr);
 	va_end (argptr);
 
 	SV_PrintToClient(cl, level, string);
@@ -207,8 +207,8 @@ void SV_BroadcastPrintf (int level, char *fmt, ...)
 	client_t	*cl;
 	int			i;
 
-	va_start (argptr,fmt);
+	va_start (argptr, fmt);
-	vsprintf (string, fmt,argptr);
+	vsnprintf (string, sizeof(string), fmt, argptr);
 	va_end (argptr);
 	
 	Sys_Printf ("%s", string);	// print to the console
@@ -238,8 +238,8 @@ void SV_BroadcastCommand (char *fmt, ...)
 	
 	if (!sv.state)
 		return;
-	va_start (argptr,fmt);
+	va_start (argptr, fmt);
-	vsprintf (string, fmt,argptr);
+	vsnprintf (string, sizeof(string), fmt, argptr);
 	va_end (argptr);
 
 	MSG_WriteByte (&sv.reliable_datagram, svc_stufftext);

source/sv_sys_win.c

@@ -68,7 +68,7 @@ void Sys_Error (char *error, ...)
 	char		text[1024];
 
 	va_start (argptr,error);
-	vsprintf (text, error,argptr);
+	vsnprintf (text, sizeof(text), error,argptr);
 	va_end (argptr);
 
 //    MessageBox(NULL, text, "Error", 0 /* MB_OK */ );

source/sv_user.c

@@ -574,7 +574,7 @@ void OutofBandPrintf(netadr_t where, char *fmt, ...)
 	send[3] = 0xff;
 	send[4] = A2C_PRINT;
 	va_start (argptr, fmt);
-	vsprintf (send+5, fmt, argptr);
+	vsnprintf (send+5, sizeof(send-5), fmt, argptr);
 	va_end (argptr);
 
 	NET_SendPacket (strlen(send)+1, send, where);
@@ -750,11 +750,11 @@ void SV_Say (qboolean team)
 	}
 
 	if (host_client->spectator && (!sv_spectalk.value || team))
-		sprintf (text, "[SPEC] %s: ", host_client->name);
+		snprintf (text, sizeof(text), "[SPEC] %s: ", host_client->name);
 	else if (team)
-		sprintf (text, "(%s): ", host_client->name);
+		snprintf (text, sizeof(text), "(%s): ", host_client->name);
 	else {
-		sprintf (text, "%s: ", host_client->name);
+		snprintf (text, sizeof(text), "%s: ", host_client->name);
 	}
 
 	if (fp_messages) {
@@ -938,9 +938,9 @@ void SV_Pause_f (void)
 	}
 
 	if (sv.paused)
-		sprintf (st, "%s paused the game\n", host_client->name);
+		snprintf (st, sizeof(st), "%s paused the game\n", host_client->name);
 	else
-		sprintf (st, "%s unpaused the game\n", host_client->name);
+		snprintf (st, sizeof(st), "%s unpaused the game\n", host_client->name);
 
 	SV_TogglePause(st);
 }

source/sys_linux.c

@@ -158,12 +158,9 @@ void Sys_Printf (char *fmt, ...)
 	unsigned char		*p;
 
 	va_start (argptr,fmt);
-	vsprintf (text,fmt,argptr);
+	vsnprintf (text, sizeof(text), fmt, argptr);
 	va_end (argptr);
 
-	if (strlen(text) > sizeof(text))
-		Sys_Error("memory overwrite in Sys_Printf");
-
 	if (nostdout)
 		return;
 
@@ -194,8 +191,8 @@ void Sys_Error (char *error, ...)
 // change stdin to non blocking
     fcntl (0, F_SETFL, fcntl (0, F_GETFL, 0) & ~FNDELAY);
     
-    va_start (argptr,error);
+    va_start (argptr, error);
-    vsprintf (string,error,argptr);
+    vsnprintf (string, sizeof(string), error, argptr);
     va_end (argptr);
 	fprintf(stderr, "Error: %s\n", string);
 
@@ -209,8 +206,8 @@ void Sys_Warn (char *warning, ...)
     va_list     argptr;
     char        string[1024];
     
-    va_start (argptr,warning);
+    va_start (argptr, warning);
-    vsprintf (string,warning,argptr);
+    vsnprintf (string, sizeof(string), warning,argptr);
     va_end (argptr);
 	fprintf(stderr, "Warning: %s", string);
 } 
@@ -293,11 +290,11 @@ int Sys_FileRead (int handle, void *dest, int count)
 void Sys_DebugLog(char *file, char *fmt, ...)
 {
     va_list argptr; 
-    static char data[1024];
+    static char data[1024];   // why static ?
     int fd;
-    
+
-    va_start(argptr, fmt);
+    va_start (argptr, fmt);
-    vsprintf(data, fmt, argptr);
+    vsnprintf (data, sizeof(data), fmt, argptr);
     va_end(argptr);
 //    fd = open(file, O_WRONLY | O_BINARY | O_CREAT | O_APPEND, 0666);
     fd = open(file, O_WRONLY | O_CREAT | O_APPEND, 0666);
@@ -322,7 +319,7 @@ void Sys_EditFile(char *filename)
 			editor = getenv("EDIT");
 		if (!editor)
 			editor = "vi";
-		sprintf(cmd, "xterm -e %s %s", editor, filename);
+		snprintf (cmd, sizeof(cmd), "xterm -e %s %s", editor, filename);
 		system(cmd);
 	}
 

source/sys_unix.c

@@ -121,8 +121,8 @@ void Sys_Error (char *error, ...)
 	va_list		argptr;
 	char		string[1024];
 	
-	va_start (argptr,error);
+	va_start (argptr, error);
-	vsprintf (string,error,argptr);
+	vsnprintf (string, sizeof(string), error,argptr);
 	va_end (argptr);
 	printf ("Fatal error: %s\n",string);
 	
@@ -140,13 +140,10 @@ void Sys_Printf (char *fmt, ...)
 	static char		text[2048];
 	unsigned char		*p;
 
-	va_start (argptr,fmt);
+	va_start (argptr, fmt);
-	vsprintf (text,fmt,argptr);
+	vsnprintf (text, sizeof(text), fmt, argptr);
 	va_end (argptr);
 
-	if (strlen(text) > sizeof(text))
-		Sys_Error("memory overwrite in Sys_Printf");
-
     if (sys_nostdout.value)
         return;
 

source/vid_glx.c

@@ -519,9 +519,9 @@ void	VID_SetPalette (unsigned char *palette)
 			}
 			d_15to8table[i]=k;
 		}
-		sprintf(s, "%s/glquake", com_gamedir);
+		snprintf (s, sizeof(s), "%s/glquake", com_gamedir);
  		Sys_mkdir (s);
-		sprintf(s, "%s/glquake/15to8.pal", com_gamedir);
+		snprintf (s, sizeof(s), "%s/glquake/15to8.pal", com_gamedir);
 		if ((f = fopen(s, "wb")) != NULL) {
 			fwrite(d_15to8table, 1<<15, 1, f);
 			fclose(f);
@@ -763,7 +763,7 @@ void VID_Init(unsigned char *palette)
 
 	GL_Init();
 
-	sprintf (gldir, "%s/glquake", com_gamedir);
+	snprintf (gldir, sizeof(gldir), "%s/glquake", com_gamedir);
 	Sys_mkdir (gldir);
 
 	VID_SetPalette(palette);