fix a bunch of the previous FIXMEs. needs a bit more work for win32

compiling

include/QF/model.h

@@ -464,7 +464,7 @@ extern struct cvar_s *gl_mesh_cache;
 extern struct cvar_s *gl_subdivide_size;
 extern struct cvar_s *gl_alias_render_tri;
 extern model_t *loadmodel;
-extern char loadname[32];
+extern char *loadname;
 extern byte *mod_base;
 extern byte mod_novis[MAX_MAP_LEAFS / 8];
 extern int mod_lightmap_bytes;

include/QF/quakefs.h

@@ -96,7 +96,7 @@ int QFS_Remove (const char *path);
 int QFS_NextFilename (struct dstring_s *filename, const char *prefix,
 					  const char *ext);
 
-void QFS_FileBase (const char *in, char *out);
+char *QFS_FileBase (const char *in);
 void QFS_DefaultExtension (char *path, const char *extension);
 void QFS_StripExtension (const char *in, char *out);
 char *QFS_CompressPath (const char *pth);

libs/models/model.c

@@ -50,7 +50,7 @@ static __attribute__ ((unused)) const char rcsid[] =
 #include "compat.h"
 
 model_t    *loadmodel;
-char        loadname[32];				// for hunk tags
+char       *loadname;					// for hunk tags
 
 #define	MAX_MOD_KNOWN	512
 model_t     mod_known[MAX_MOD_KNOWN];
@@ -157,7 +157,9 @@ Mod_RealLoadModel (model_t *mod, qboolean crash, cache_allocator_t allocator)
 	}
 
 	// allocate a new model
-	QFS_FileBase (mod->name, loadname);
+	if (loadname)
+		free (loadname);
+	loadname = QFS_FileBase (mod->name);
 
 	loadmodel = mod;
 

libs/net/nm/net_dgrm.c

@@ -122,21 +122,6 @@ struct {
 //extern char m_return_reason[32];
 
 
-#ifdef DEBUG
-char       *
-StrAddr (struct qsockaddr *addr)
-{
-	static char buf[34];		//FIXME: overflow
-	byte       *p = (byte *) addr;
-	int         n;
-
-	for (n = 0; n < 16; n++)
-		snprintf (buf + n * 2, sizeof (buf + n * 2), "%02x", *p++);
-	return buf;
-}
-#endif
-
-
 #ifdef BAN_TEST
 unsigned long banAddr = 0x00000000;
 unsigned long banMask = 0xffffffff;
@@ -198,16 +183,6 @@ Datagram_SendMessage (qsocket_t * sock, sizebuf_t *data)
 	unsigned int dataLen;
 	unsigned int eom;
 
-#ifdef DEBUG
-	if (data->cursize == 0)
-		Sys_Error ("Datagram_SendMessage: zero length message");
-
-	if (data->cursize > NET_MAXMESSAGE)
-		Sys_Error ("Datagram_SendMessage: message too big %u", data->cursize);
-
-	if (sock->canSend == false)
-		Sys_Error ("SendMessage: called with canSend == false");
-#endif
 
 	memcpy (sock->sendMessage, data->data, data->cursize);
 	sock->sendMessageLength = data->cursize;
@@ -323,15 +298,6 @@ Datagram_SendUnreliableMessage (qsocket_t * sock, sizebuf_t *data)
 {
 	int         packetLen;
 
-#ifdef DEBUG
-	if (data->cursize == 0)
-		Sys_Error ("Datagram_SendUnreliableMessage: zero length message");
-
-	if (data->cursize > MAX_DATAGRAM)
-		Sys_Error ("Datagram_SendUnreliableMessage: message too big %u",
-				   data->cursize);
-#endif
-
 	packetLen = NET_HEADERSIZE + data->cursize;
 
 	packetBuffer.length = BigLong (packetLen | NETFLAG_UNRELIABLE);
@@ -378,11 +344,6 @@ Datagram_GetMessage (qsocket_t * sock)
 		}
 
 		if (sfunc.AddrCompare (&readaddr, &sock->addr) != 0) {
-#ifdef DEBUG
-			Con_DPrintf ("Forged packet received\n");
-			Con_DPrintf ("Expected: %s\n", StrAddr (&sock->addr));
-			Con_DPrintf ("Received: %s\n", StrAddr (&readaddr));
-#endif
 			continue;
 		}
 
@@ -1324,12 +1285,6 @@ _Datagram_Connect (const char *host)
 			if (ret > 0) {
 				// is it from the right place?
 				if (sfunc.AddrCompare (&readaddr, &sendaddr) != 0) {
-#ifdef DEBUG
-					Con_Printf ("wrong reply address\n");
-					Con_Printf ("Expected: %s\n", StrAddr (&sendaddr));
-					Con_Printf ("Received: %s\n", StrAddr (&readaddr));
-					CL_UpdateScreen (cl.time);
-#endif
 					ret = 0;
 					continue;
 				}

libs/net/nm/net_udp.c

@@ -78,10 +78,12 @@ static __attribute__ ((unused)) const char rcsid[] =
 #include <stdlib.h>
 #include <sys/types.h>
 
+#include "QF/console.h"
 #include "QF/cvar.h"
+#include "QF/dstring.h"
 #include "QF/qargs.h"
 #include "QF/sys.h"
-#include "QF/console.h"
+#include "QF/va.h"
 
 #include "compat.h"
 #include "netmain.h"
@@ -248,13 +250,12 @@ UDP_CloseSocket (int socket)
 static int
 PartialIPAddress (const char *in, struct qsockaddr *hostaddr)
 {
-	char        buff[256];		//FIXME: overflow
+	char       *buff;
 	char       *b;
 	int         addr, mask, num, port, run;
 
-	buff[0] = '.';
+	buff = nva (".%s", in);
 	b = buff;
-	strcpy (buff + 1, in);
 	if (buff[1] == '.')
 		b++;
 
@@ -267,12 +268,12 @@ PartialIPAddress (const char *in, struct qsockaddr *hostaddr)
 		while (!(*b < '0' || *b > '9')) {
 			num = num * 10 + *b++ - '0';
 			if (++run > 3)
-				return -1;
+				goto error;
 		}
 		if ((*b < '0' || *b > '9') && *b != '.' && *b != ':' && *b != 0)
-			return -1;
+			goto error;
 		if (num < 0 || num > 255)
-			return -1;
+			goto error;
 		mask <<= 8;
 		addr = (addr << 8) + num;
 	}
@@ -288,7 +289,11 @@ PartialIPAddress (const char *in, struct qsockaddr *hostaddr)
 	((struct sockaddr_in *) hostaddr)->sin_addr.s_addr =
 		(myAddr & htonl (mask)) | htonl (addr);
 
+	free (buff);
 	return 0;
+error:
+	free (buff);
+	return -1;
 }
 
 int
@@ -374,17 +379,20 @@ UDP_Write (int socket, byte * buf, int len, struct qsockaddr *addr)
 	return ret;
 }
 
-const char       *
+const char *
 UDP_AddrToString (struct qsockaddr *addr)
 {
-	static char buffer[22];		//FIXME: overflow
+	static dstring_t *buffer;
 	int         haddr;
 
+	if (!buffer)
+		buffer = dstring_new ();
+
 	haddr = ntohl (((struct sockaddr_in *) addr)->sin_addr.s_addr);
-	snprintf (buffer, sizeof (buffer), "%d.%d.%d.%d:%d", (haddr >> 24) & 0xff,
+	dsprintf (buffer, "%d.%d.%d.%d:%d", (haddr >> 24) & 0xff,
 			  (haddr >> 16) & 0xff, (haddr >> 8) & 0xff, haddr & 0xff,
 			  ntohs (((struct sockaddr_in *) addr)->sin_port));
-	return buffer;
+	return buffer->str;
 }
 
 int

libs/util/quakefs.c

@@ -529,10 +529,11 @@ no_config:
 	qfs_gd_plist = PL_GetPropertyList (qfs_default_dirconf);
 }
 
-void
+char *
-QFS_FileBase (const char *in, char *out)
+QFS_FileBase (const char *in)
 {
 	const char *slash, *dot, *s;
+	char       *out;
 
 	slash = in;
 	dot = NULL;
@@ -547,12 +548,11 @@ QFS_FileBase (const char *in, char *out)
 	if (dot == NULL)
 		dot = s;
 	if (dot - slash < 2)
-		strcpy (out, "?model?");
+		return strdup ("?model?");
-	else {
+	out = malloc (dot - slash + 1);
-		while (slash < dot)
+	strncpy (out, slash, dot - slash);
-			*out++ = *slash++;
+	out [dot - slash] = 0;
-		*out++ = 0;
+	return out;
-	}
 }
 
 
@@ -751,7 +751,7 @@ static int
 open_file (searchpath_t *search, const char *filename, QFile **gzfile,
 		   dstring_t *foundname, int zip)
 {
-	char        netpath[MAX_OSPATH];		//FIXME: overflow
+	char       *netpath;
 
 	file_from_pak = 0;
 
@@ -782,19 +782,21 @@ open_file (searchpath_t *search, const char *filename, QFile **gzfile,
 					   (int) sizeof (netpath), search->filename,
 					   (int) sizeof (netpath), filename);
 		// check a file in the directory tree
-		snprintf (netpath, sizeof (netpath), "%s/%s", search->filename,
+		netpath = nva ("%s/%s", search->filename, filename);
-				  filename);
 
 		if (foundname) {
 			dstring_clearstr (foundname);
 			dstring_appendstr (foundname, filename);
 		}
-		if (Sys_FileTime (netpath) == -1)
+		if (Sys_FileTime (netpath) == -1) {
+			free (netpath);
 			return -1;
+		}
 
 		Sys_DPrintf ("FindFile: %s\n", netpath);
 
 		*gzfile = QFS_OpenRead (netpath, -1, -1, zip);
+		free (netpath);
 		return qfs_filesize;
 	}
 
@@ -808,10 +810,10 @@ _QFS_FOpenFile (const char *filename, QFile **gzfile,
 	searchpath_t *search;
 	char       *path;
 #ifdef HAVE_VORBIS
-	char        oggfilename[MAX_OSPATH];		//FIXME: overflow
+	char       *oggfilename;
 #endif
 #ifdef HAVE_ZLIB
-	char        gzfilename[MAX_OSPATH];		//FIXME: overflow
+	char       *gzfilename;
 #endif
 
 	// make sure they're not trying to do weird stuff with our private files
@@ -823,14 +825,16 @@ _QFS_FOpenFile (const char *filename, QFile **gzfile,
 
 #ifdef HAVE_VORBIS
 	if (strequal (".wav", QFS_FileExtension (path))) {
+		oggfilename = alloca (strlen (path) + 1);
 		QFS_StripExtension (path, oggfilename);
 		strncat (oggfilename, ".ogg",
 				 sizeof (oggfilename) - strlen (oggfilename) - 1);
 	} else {
-		oggfilename[0] = 0;
+		oggfilename = 0;
 	}
 #endif
 #ifdef HAVE_ZLIB
+	gzfilename = alloca (strlen (path) + 3 + 1);
 	snprintf (gzfilename, sizeof (gzfilename), "%s.gz", path);
 #endif
 
@@ -838,7 +842,7 @@ _QFS_FOpenFile (const char *filename, QFile **gzfile,
 	for (search = qfs_searchpaths; search; search = search->next) {
 #ifdef HAVE_VORBIS
 		//NOTE gzipped oggs not supported
-		if (oggfilename[0]
+		if (oggfilename
 			&& open_file (search, oggfilename, gzfile, foundname, false) != -1)
 			goto ok;
 #endif
@@ -882,7 +886,7 @@ QFS_LoadFile (const char *path, int usehunk)
 {
 	QFile      *h;
 	byte       *buf = NULL;
-	char        base[32];		//FIXME: overflow
+	char       *base;
 	int         len;
 
 	// look for it in the filesystem or pack files
@@ -891,7 +895,7 @@ QFS_LoadFile (const char *path, int usehunk)
 		return NULL;
 
 	// extract the filename base name for hunk tag
-	QFS_FileBase (path, base);
+	base = QFS_FileBase (path);
 
 	if (usehunk == 1)
 		buf = Hunk_AllocName (len + 1, base);
@@ -916,6 +920,8 @@ QFS_LoadFile (const char *path, int usehunk)
 	Qread (h, buf, len);
 	Qclose (h);
 
+	free (base);
+
 	return buf;
 }
 

libs/util/quakeio.c

@@ -133,11 +133,12 @@ QFile *
 Qopen (const char *path, const char *mode)
 {
 	QFile      *file;
-	char        m[80], *p;		//FIXME: overflow
+	char       *m, *p;
 	int         reading = 0;
 	int         zip = 0;
 	int         size = -1;
 
+	m = alloca (strlen (mode) + 1);
 	for (p = m; *mode && p - m < ((int) sizeof (m) - 1); mode++) {
 		if (*mode == 'z') {
 			zip = 1;
@@ -191,9 +192,10 @@ QFile *
 Qdopen (int fd, const char *mode)
 {
 	QFile      *file;
-	char        m[80], *p;		//FIXME: overflow
+	char       *m, *p;
 	int         zip = 0;
 
+	m = alloca (strlen (mode) + 1);
 #ifdef WIN32
 	setmode (fd, O_BINARY);
 #endif

nq/source/host.c

@@ -129,19 +129,22 @@ cvar_t     *temp1;
 void
 Host_EndGame (const char *message, ...)
 {
-	char        string[1024];		//FIXME: overflow
+	static dstring_t *str;
 	va_list     argptr;
 
+	if (!str)
+		str = dstring_new ();
+
 	va_start (argptr, message);
-	vsnprintf (string, sizeof (string), message, argptr);
+	dvsprintf (str, message, argptr);
 	va_end (argptr);
-	Con_DPrintf ("Host_EndGame: %s\n", string);
+	Con_DPrintf ("Host_EndGame: %s\n", str->str);
 
 	if (sv.active)
 		Host_ShutdownServer (false);
 
 	if (cls.state == ca_dedicated)
-		Sys_Error ("Host_EndGame: %s", string);	// dedicated servers exit
+		Sys_Error ("Host_EndGame: %s", str->str);	// dedicated servers exit
 
 	if (cls.demonum != -1)
 		CL_NextDemo ();
@@ -159,27 +162,31 @@ Host_EndGame (const char *message, ...)
 void
 Host_Error (const char *error, ...)
 {
-	char        string[1024];		//FIXME: overflow
+	static dstring_t *str;
 	static qboolean inerror = false;
 	va_list     argptr;
 
 	if (inerror)
 		Sys_Error ("Host_Error: recursively entered");
+
+	if (!str)
+		str = dstring_new ();
+
 	inerror = true;
 
 //	SCR_EndLoadingPlaque ();						// reenable screen updates
 
 	va_start (argptr, error);
-	vsnprintf (string, sizeof (string), error, argptr);
+	dvsprintf (str, error, argptr);
 	va_end (argptr);
 
 	if (sv.active)
 		Host_ShutdownServer (false);
 
 	if (cls.state == ca_dedicated)
-		Sys_Error ("Host_Error: %s", string);		// dedicated servers exit
+		Sys_Error ("Host_Error: %s", str->str);		// dedicated servers exit
 
-	Con_Printf ("Host_Error: %s\n", string);
+	Con_Printf ("Host_Error: %s\n", str->str);
 
 	CL_Disconnect ();
 	cls.demonum = -1;
@@ -303,15 +310,18 @@ Host_WriteConfiguration (void)
 void
 SV_ClientPrintf (const char *fmt, ...)
 {
-	char        string[1024];		//FIXME: overflow
+	static dstring_t *str;
 	va_list     argptr;
 
+	if (!str)
+		str = dstring_new ();
+
 	va_start (argptr, fmt);
-	vsnprintf (string, sizeof (string), fmt, argptr);
+	dvsprintf (str, fmt, argptr);
 	va_end (argptr);
 
 	MSG_WriteByte (&host_client->message, svc_print);
-	MSG_WriteString (&host_client->message, string);
+	MSG_WriteString (&host_client->message, str->str);
 }
 
 /*
@@ -322,18 +332,21 @@ SV_ClientPrintf (const char *fmt, ...)
 void
 SV_BroadcastPrintf (const char *fmt, ...)
 {
-	char        string[1024];		//FIXME: overflow
+	static dstring_t *str;
 	int         i;
 	va_list     argptr;
 
+	if (!str)
+		str = dstring_new ();
+
 	va_start (argptr, fmt);
-	vsnprintf (string, sizeof (string), fmt, argptr);
+	dvsprintf (str, fmt, argptr);
 	va_end (argptr);
 
 	for (i = 0; i < svs.maxclients; i++)
 		if (svs.clients[i].active && svs.clients[i].spawned) {
 			MSG_WriteByte (&svs.clients[i].message, svc_print);
-			MSG_WriteString (&svs.clients[i].message, string);
+			MSG_WriteString (&svs.clients[i].message, str->str);
 		}
 }
 
@@ -345,15 +358,18 @@ SV_BroadcastPrintf (const char *fmt, ...)
 void
 Host_ClientCommands (const char *fmt, ...)
 {
-	char        string[1024];		//FIXME: overflow
+	static dstring_t *str;
 	va_list     argptr;
 
+	if (!str)
+		str = dstring_new ();
+
 	va_start (argptr, fmt);
-	vsnprintf (string, sizeof (string), fmt, argptr);
+	dvsprintf (str, fmt, argptr);
 	va_end (argptr);
 
 	MSG_WriteByte (&host_client->message, svc_stufftext);
-	MSG_WriteString (&host_client->message, string);
+	MSG_WriteString (&host_client->message, str->str);
 }
 
 /*

nq/source/sbar.c

@@ -334,10 +334,13 @@ draw_fill (view_t *view, int x, int y, int w, int h, int col)
 static void
 draw_num (view_t *view, int x, int y, int num, int digits, int color)
 {
-	char        str[12];		//FIXME: overflow
+	char        str[12];
 	char       *ptr;
 	int         l, frame;
 
+	if (num > 999999999)
+		num = 999999999;
+
 	l = snprintf (str, sizeof (str), "%d", num);
 	ptr = str;
 	if (l > digits)
@@ -360,10 +363,13 @@ draw_num (view_t *view, int x, int y, int num, int digits, int color)
 static inline void
 draw_smallnum (view_t *view, int x, int y, int n, int packed, int colored)
 {
-	char        num[4];		//FIXME: overflow
+	char        num[4];
 
 	packed = packed != 0;				// ensure 0 or 1
 
+	if (n > 999)
+		n = 999;
+
 	snprintf (num, sizeof (num), "%3d", n);
 	if (colored) {
 		if (num[0] != ' ')
@@ -422,7 +428,7 @@ Sbar_SortFrags (void)
 static void
 draw_solo (view_t *view)
 {
-	char        str[80];		//FIXME: overflow
+	char        str[80];
 	int         minutes, seconds, tens, units;
 	int         l;
 
@@ -583,7 +589,6 @@ draw_frags (view_t *view)
 	int         i, k, l, p = -1;
 	int         top, bottom;
 	int         x;
-	char        num[12];		//FIXME: overflow
 	scoreboard_t *s;
 
 	if (cl.maxclients == 1)
@@ -611,12 +616,7 @@ draw_frags (view_t *view)
 		draw_fill (view, x + 4, 1, 28, 4, top);
 		draw_fill (view, x + 4, 5, 28, 3, bottom);
 
-		// draw number
+		draw_smallnum (view, x + 6, 0, s->frags, 0, 0);
-		snprintf (num, sizeof (num), "%3i", s->frags);
-
-		draw_character (view, x + 6, 0, num[0]);
-		draw_character (view, x + 14, 0, num[1]);
-		draw_character (view, x + 22, 0, num[2]);
 
 		if (k == cl.viewentity - 1)
 			p = i;
@@ -1047,8 +1047,7 @@ Sbar_DeathmatchOverlay (view_t *view)
 {
 	int         i, k, l;
 	int         top, bottom;
-	int         x, y, f;
+	int         x, y;
-	char        num[12];		//FIXME: overflow
 	scoreboard_t *s;
 
 	scr_copyeverything = 1;
@@ -1079,11 +1078,7 @@ Sbar_DeathmatchOverlay (view_t *view)
 		draw_fill (view, x, y, 40, 4, top);
 		draw_fill (view, x, y + 4, 40, 4, bottom);
 
-		// draw number
+		draw_smallnum (view, x + 12, y, s->frags, 0, 0);
-		f = s->frags;
-		snprintf (num, sizeof (num), "%3i", f);
-
-		draw_nstring (view, x + 12, y, num, 3);
 
 		if (k == cl.viewentity - 1)
 			draw_character (view, x - 4, y, 12);
@@ -1120,7 +1115,6 @@ draw_time (view_t *view)
 static void
 draw_fps (view_t *view)
 {
-	char          st[80];		//FIXME: overflow
 	double        t;
 	static double lastframetime;
 	static int    lastfps;
@@ -1131,8 +1125,7 @@ draw_fps (view_t *view)
 		fps_count = 0;
 		lastframetime = t;
 	}
-	snprintf (st, sizeof (st), "%3d FPS", lastfps);
+	draw_smallnum (view, 8, 8, lastfps, 0, 0);
-	draw_string (view, 8, 8, st);
 }
 
 static void

qw/source/cl_main.c

@@ -251,7 +251,7 @@ CL_Version_f (void)
 static void
 CL_SendConnectPacket (void)
 {
-	char        data[2048];		//FIXME: overflow
+	dstring_t  *data;
 	double      t1, t2;
 
 // JACK: Fixed bug where DNS lookups would cause two connects real fast
@@ -277,10 +277,12 @@ CL_SendConnectPacket (void)
 
 	cls.qport = qport->int_val;
 
-	snprintf (data, sizeof (data), "%c%c%c%cconnect %i %i %i \"%s\"\n",
+	data = dstring_new ();
+	dsprintf (data, "%c%c%c%cconnect %i %i %i \"%s\"\n",
 			  255, 255, 255, 255, PROTOCOL_VERSION, cls.qport, cls.challenge,
 			  Info_MakeString (cls.userinfo, 0));
-	Netchan_SendPacket (strlen (data), data, cls.server_addr);
+	Netchan_SendPacket (strlen (data->str), data->str, cls.server_addr);
+	dstring_delete (data);
 }
 
 /*
@@ -291,7 +293,7 @@ CL_SendConnectPacket (void)
 static void
 CL_CheckForResend (void)
 {
-	char        data[2048];		//FIXME: overflow
+	static const char *getchallenge = "\377\377\377\377getchallenge\n";
 	double      t1, t2;
 
 	if (connect_time == -1)
@@ -316,9 +318,8 @@ CL_CheckForResend (void)
 
 	VID_SetCaption (va ("Connecting to %s", cls.servername));
 	Con_Printf ("Connecting to %s...\n", cls.servername);
-	snprintf (data, sizeof (data), "%c%c%c%cgetchallenge\n", 255, 255, 255,
+	Netchan_SendPacket (strlen (getchallenge), (void *) getchallenge,
-			  255);
+						cls.server_addr);
-	Netchan_SendPacket (strlen (data), data, cls.server_addr);
 }
 
 void
@@ -355,11 +356,14 @@ CL_Connect_f (void)
 static void
 CL_Rcon_f (void)
 {
-	char        message[1024];		//FIXME: overflow
+	static dstring_t *message;
 	netadr_t    to;
 
-	snprintf (message, sizeof (message), "\377\377\377\377rcon %s %s",
+	if (!message)
-			  rcon_password->string, Cmd_Args (1));
+		message = dstring_new ();
+
+	dsprintf (message, "\377\377\377\377rcon %s %s", rcon_password->string,
+			  Cmd_Args (1));
 
 	if (cls.state >= ca_connected)
 		to = cls.netchan.remote_address;
@@ -374,7 +378,7 @@ CL_Rcon_f (void)
 			to.port = BigShort (27500);
 	}
 
-	Netchan_SendPacket (strlen (message) + 1, message, to);
+	Netchan_SendPacket (strlen (message->str) + 1, message->str, to);
 }
 
 void
@@ -624,8 +628,6 @@ CL_FullServerinfo_f (void)
 static void
 CL_AddQFInfoKeys (void)
 {
-	char        cap[100] = "";			// max of 98 or so flags		//FIXME: overflow
-
 	// set the capabilities info. single char flags (possibly with modifiers)
 	// defined capabilities (* = not implemented):
 	// z   client can accept gzipped files.
@@ -635,10 +637,12 @@ CL_AddQFInfoKeys (void)
 	// i    * irc
 	// p    pogo stick control
 	// t    team messages
-	strncpy (cap, "pt", sizeof (cap));
+	static const char *cap = "pt"
 #ifdef HAVE_ZLIB
-	strncat (cap, "z", sizeof (cap) - strlen (cap) - 1);
+		"z"
 #endif
+		;
+
 	Info_SetValueForStarKey (cls.userinfo, "*cap", cap, 0);
 	Info_SetValueForStarKey (cls.userinfo, "*qf_version", VERSION, 0);
 	Info_SetValueForStarKey (cls.userinfo, "*qsg_version", QW_QSG_VERSION, 0);
@@ -730,7 +734,7 @@ CL_SetInfo_f (void)
 static void
 CL_Packet_f (void)
 {
-	char        send[2048];		//FIXME: overflow
+	char       *send;
 	char       *out;
 	const char *in;
 	int         i, l;
@@ -747,6 +751,7 @@ CL_Packet_f (void)
 	}
 
 	in = Cmd_Argv (2);
+	send = malloc (strlen (in) + 4 + 1);
 	out = send + 4;
 	send[0] = send[1] = send[2] = send[3] = 0xff;
 
@@ -761,6 +766,7 @@ CL_Packet_f (void)
 	*out = 0;
 
 	Netchan_SendPacket (out - send, send, adr);
+	free (send);
 }
 
 /*
@@ -771,8 +777,6 @@ CL_Packet_f (void)
 void
 CL_NextDemo (void)
 {
-	char        str[1024];		//FIXME: overflow
-
 	if (cls.demonum == -1)
 		return;							// don't play demos
 
@@ -784,8 +788,7 @@ CL_NextDemo (void)
 		}
 	}
 
-	snprintf (str, sizeof (str), "playdemo %s\n", cls.demos[cls.demonum]);
+	Cbuf_InsertText (cl_cbuf, va ("playdemo %s\n", cls.demos[cls.demonum]));
-	Cbuf_InsertText (cl_cbuf, str);
 	cls.demonum++;
 }
 
@@ -878,7 +881,7 @@ CL_ConnectionlessPacket (void)
 	}
 	// remote command from gui front end
 	if (c == A2C_CLIENT_COMMAND) {
-		char        cmdtext[2048];		//FIXME: overflow
+		char       *cmdtext;
 		int         len;
 
 		Con_Printf ("client command\n");
@@ -892,8 +895,8 @@ CL_ConnectionlessPacket (void)
 		}
 		s = MSG_ReadString (net_message);
 
-		strncpy (cmdtext, s, sizeof (cmdtext) - 1);
+		cmdtext = alloca (strlen (s) + 1);
-		cmdtext[sizeof (cmdtext) - 1] = 0;
+		strcpy (cmdtext, s);
 
 		s = MSG_ReadString (net_message);
 
@@ -1128,12 +1131,9 @@ CL_SetState (cactive_t state)
 void
 CL_Init (void)
 {
-	char        st[80];		//FIXME: overflow
-
 	CL_SetState (ca_disconnected);
 
-	snprintf (st, sizeof (st), "%s", QW_VERSION);
+	Info_SetValueForStarKey (cls.userinfo, "*ver", QW_VERSION, 0);
-	Info_SetValueForStarKey (cls.userinfo, "*ver", st, 0);
 
 	CL_Input_Init ();
 	CL_Ents_Init ();
@@ -1337,14 +1337,17 @@ CL_Init_Cvars (void)
 void
 Host_EndGame (const char *message, ...)
 {
-	char        string[1024];		//FIXME: overflow
+	static dstring_t *str;
 	va_list     argptr;
 
+	if (!str)
+		str = dstring_new ();
+
 	va_start (argptr, message);
-	vsnprintf (string, sizeof (string), message, argptr);
+	dvsprintf (str, message, argptr);
 	va_end (argptr);
 	Con_Printf ("\n===========================\n");
-	Con_Printf ("Host_EndGame: %s\n", string);
+	Con_Printf ("Host_EndGame: %s\n", str->str);
 	Con_Printf ("===========================\n\n");
 
 	CL_Disconnect ();
@@ -1360,29 +1363,33 @@ Host_EndGame (const char *message, ...)
 void
 Host_Error (const char *error, ...)
 {
-	char        string[1024];		//FIXME: overflow
+	static dstring_t *str;
 	static qboolean inerror = false;
 	va_list     argptr;
 
 	if (inerror)
 		Sys_Error ("Host_Error: recursively entered");
+
+	if (!str)
+		str = dstring_new ();
+
 	inerror = true;
 
 	va_start (argptr, error);
-	Con_Printf ("Host_Error: ");
+	dvsprintf (str, error, argptr);
-	Con_Print (error, argptr);
 	va_end (argptr);
 
+	Con_Printf ("Host_Error: %s", str->str);
+
 	CL_Disconnect ();
 	cls.demonum = -1;
 
 	inerror = false;
 
-// FIXME
 	if (host_initialized) {
 		longjmp (host_abort, 1);
 	} else {
-		Sys_Error ("Host_Error: %s", string);
+		Sys_Error ("Host_Error: %s", str->str);
 	}
 }
 

qw/source/master.c

@@ -336,7 +336,7 @@ QW_Master (struct sockaddr_in *addr)
    
 	while (1) {
 		int size;
-		char buf[31];		//FIXME: overflow
+		char buf[31];
 		MSGHDR;
 
 		buf[30] = '\0'; // a sentinal for string ops

qw/source/sbar.c

@@ -348,10 +348,13 @@ draw_fill (view_t *view, int x, int y, int w, int h, int col)
 static void
 draw_num (view_t *view, int x, int y, int num, int digits, int color)
 {
-	char        str[12];		//FIXME: overflow
+	char        str[12];
 	char       *ptr;
 	int         l, frame;
 
+	if (num > 999999999)
+		num = 999999999;
+
 	l = snprintf (str, sizeof (str), "%d", num);
 	ptr = str;
 	if (l > digits)
@@ -483,7 +486,7 @@ Sbar_ColorForMap (int m)
 static void
 draw_solo (view_t *view)
 {
-	char        str[80];		//FIXME: overflow
+	char        str[80];
 	int         minutes, seconds;
 
 	draw_pic (view, 0, 0, sb_scorebar); 
@@ -494,17 +497,39 @@ draw_solo (view_t *view)
 	draw_string (view, 184, 4, str);
 }
 
+static inline void
+draw_smallnum (view_t *view, int x, int y, int n, int packed, int colored)
+{
+	char        num[4];
+
+	packed = packed != 0;				// ensure 0 or 1
+
+	if (n > 999)
+		n = 999;
+
+	snprintf (num, sizeof (num), "%3d", n);
+	if (colored) {
+		if (num[0] != ' ')
+			num[0] = 18 + num[0] - '0';
+		if (num[1] != ' ')
+			num[1] = 18 + num[1] - '0';
+		if (num[2] != ' ')
+			num[2] = 18 + num[2] - '0';
+	}
+	draw_character (view, x + packed, y, num[0]);
+	draw_character (view, x + 8, y, num[1]);
+	draw_character (view, x + 16 - packed, y, num[2]);
+}
+
 static inline void
 dmo_ping (view_t *view, int x, int y, player_info_t *s)
 {
-	char		num[12];		//FIXME: overflow
 	int         p;
 
 	p = s->ping;
 	if (p < 0 || p > 999)
 		p = 999;
-	snprintf (num, sizeof (num), "%4i", p);
+	draw_smallnum (view, x + 8, y, p, 0, 0);
-	draw_string (view, x, y, num);
 }
 
 static inline void
@@ -521,16 +546,11 @@ dmo_uid (view_t *view, int x, int y, player_info_t *s)
 static inline void
 dmo_pl (view_t *view, int x, int y, player_info_t *s)
 {
-	char		num[12];		//FIXME: overflow
 	int         p;
 
 	// draw pl
 	p = s->pl;
-	snprintf (num, sizeof (num), "%3i", p);
+	draw_smallnum (view, x, y, p, 0, p > 25);
-	if (p > 25)
-		draw_altstring (view, x, y, num);
-	else
-		draw_string (view, x, y, num);
 }
 
 static inline int
@@ -555,7 +575,7 @@ calc_fph (int frags, int total)
 static inline void
 dmo_main (view_t *view, int x, int y, player_info_t *s, int is_client)
 {
-	char		num[12];		//FIXME: overflow
+	char		num[12];
 	int			fph, minutes, total, top, bottom, f;
 
 	// get time
@@ -663,7 +683,7 @@ draw_weapons_hud (view_t *view)
 static void
 draw_ammo_sbar (view_t *view)
 {
-	char        num[6];		//FIXME: overflow
+	char        num[12];		//FIXME: overflow
 	int         i;
 
 	// ammo counts
@@ -684,7 +704,7 @@ draw_ammo_sbar (view_t *view)
 static void
 draw_ammo_hud (view_t *view)
 {
-	char        num[6];		//FIXME: overflow
+	char        num[12];		//FIXME: overflow
 	int         i;
 
 	// ammo counts
@@ -758,7 +778,6 @@ draw_frags (view_t *view)
 	int         i, k, l, p = -1;
 	int         top, bottom;
 	int         x;
-	char        num[12];		//FIXME: overflow
 	player_info_t *s;
 
 	Sbar_SortFrags (false);
@@ -786,12 +805,7 @@ draw_frags (view_t *view)
 		draw_fill (view, x + 4, 1, 28, 4, top);
 		draw_fill (view, x + 4, 5, 28, 3, bottom);
 
-		// draw number
+		draw_smallnum (view, x + 6, 0, s->frags, 0, 0);
-		snprintf (num, sizeof (num), "%3i", s->frags);
-
-		draw_character (view, x + 6, 0, num[0]);
-		draw_character (view, x + 14, 0, num[1]);
-		draw_character (view, x + 22, 0, num[2]);
 
 		if (k == cl.playernum)
 			p = i;
@@ -843,7 +857,7 @@ draw_face (view_t *view)
 static void
 draw_spectator (view_t *view)
 {
-	char        st[512];		//FIXME: overflow
+	char        st[512];
 
 	if (autocam != CAM_TRACK) {
 		draw_string (view, 160 - 7 * 8, 4, "SPECTATOR MODE");
@@ -1060,10 +1074,9 @@ Sbar_TeamOverlay (view_t *view)
 void
 Sbar_LogFrags (void)
 {
-	char        num[512];		//FIXME: overflow
+	char       *name;
-	char        conv[512];		//FIXME: overflow
+	char       *team;
-	char        conv2[512];		//FIXME: overflow
+	byte       *cp = NULL;
-	char       *cp = NULL;
 	QFile      *file = NULL;
 	int         minutes, fph, total, d, f, i, k, l, p;
 	player_info_t *s = NULL;
@@ -1080,12 +1093,8 @@ Sbar_LogFrags (void)
 	if (t)
 		Qwrite (file, t, strlen (t));
 
-	Qwrite (file, cls.servername, strlen (cls.servername));
+	Qprintf (file, "%s\n%s %s\n", cls.servername, cl.worldmodel->name,
-	Qwrite (file, "\n", 1);
+			 cl.levelname);
-	Qwrite (file, cl.worldmodel->name, strlen (cl.worldmodel->name));
-	Qwrite (file, " ", 1);
-	Qwrite (file, cl.levelname, strlen (cl.levelname));
-	Qwrite (file, "\n", 1);
 
 	// scores   
 	Sbar_SortFrags (true);
@@ -1123,29 +1132,29 @@ Sbar_LogFrags (void)
 
 		fph = calc_fph (f, total);
 
-		memset (&conv, 0, 512);
+		name = malloc (strlen (s->name) + 1);
-		for (cp = (unsigned char *) s->name, d = 0; *cp; cp++, d++)
+		for (cp = s->name, d = 0; *cp; cp++, d++)
-			conv[d] = sys_char_map[(unsigned int) *cp];
+			name[d] = sys_char_map[*cp];
+		name[d] = 0;
 		
 		if (s->spectator) {
-			snprintf (num, sizeof (num), "%-3i%% %s (spectator)", s->pl,
+			Qprintf (file, "%-3i%% %s (spectator)", s->pl, name);
-					  (char *) &conv);
 		} else {
 			if (cl.teamplay) {
-				memset (&conv2, 0, 512);
+				team = malloc (strlen (s->team->value) + 1);
-				for (cp = (unsigned char *) s->team->value, d = 0; *cp; cp++,
+				for (cp = (byte *) s->team->value, d = 0; *cp; cp++, d++)
-						 d++)
+					team[d] = sys_char_map[*cp];
-					conv2[d] = sys_char_map[(unsigned int) *cp];
+				team[d] = 0;
 
-				snprintf (num, sizeof (num), "%-3i%% %-3i %-4i %-3i    "
+				Qprintf (file, "%-3i%% %-3i %-4i %-3i    %-4s %s",
-						  "%-4s %s", s->pl, fph, minutes, f, (char *) &conv2,
+						 s->pl, fph, minutes, f, team, name);
-						  (char *) &conv);
+				free (team);
 			} else {
-				snprintf (num, sizeof (num), "%-3i%% %-3i %-4i %-3i   %s",
+				Qprintf (file, "%-3i%% %-3i %-4i %-3i   %s",
-						  s->pl, fph, minutes, f, (char *) &conv);
+						  s->pl, fph, minutes, f, name);
 			}
 		}
-		Qwrite (file, num, strlen (num));
+		free (name);
 		Qwrite (file, "\n\n", 1);
 	}
 	
@@ -1553,13 +1562,7 @@ draw_miniteam (view_t *view)
 	if (!cl.teamplay)
 		return;
 	Sbar_SortTeams ();
-/*
+
-	// draw separator
-	x += 208;
-	if (hud_sbar_separator->int_val)
-		for (y = vid.height - sb_lines; y < (int) vid.height - 6; y += 2)
-			Draw_Character (x, y, 14);
-*/
 	x = 0;
 	y = 0;
 	for (i = 0; i < scoreboardteams && y <= view->ylen; i++) {

qw/source/sv_ccmds.c

@@ -157,7 +157,7 @@ SV_Match_User (const char *substr)
 static void
 SV_SetMaster_f (void)
 {
-	char        data[2];		//FIXME: overflow
+	char        data[2];
 	int         i;
 
 	memset (&master_adr, 0, sizeof (master_adr));

qw/source/sv_pr_cmds.c

@@ -1409,7 +1409,6 @@ void
 PF_infokey (progs_t *pr)
 {
 	const char *key, *value;
-	static char ov[256];		//FIXME: overflow
 	edict_t    *e;
 	int         e1;
 
@@ -1430,15 +1429,12 @@ PF_infokey (progs_t *pr)
 	} else if (e1 > 0 && e1 <= MAX_CLIENTS
 			   && svs.clients[e1 - 1].userinfo) {
 		if (!strcmp (key, "ip"))
-			value =
+			value = NET_BaseAdrToString (svs.clients[e1 - 1].netchan.
-				strcpy (ov,
+										 remote_address);
-						NET_BaseAdrToString (svs.clients[e1 - 1].netchan.
-											 remote_address));
 		else if (!strcmp (key, "ping")) {
 			int         ping = SV_CalcPing (&svs.clients[e1 - 1]);
 
-			snprintf (ov, sizeof (ov), "%d", ping);
+			value = va ("%d", ping);
-			value = ov;
 		} else
 			value = Info_ValueForKey (svs.clients[e1 - 1].userinfo, key);
 	} else
@@ -1538,7 +1534,7 @@ PF_setinfokey (progs_t *pr)
 	int         e1 = NUM_FOR_EDICT (pr, edict);
 	const char *key = P_GSTRING (pr, 1);
 	const char *value = P_GSTRING (pr, 2);
-	char		oldval[MAX_INFO_STRING];		//FIXME: overflow
+	char       *oldval = 0;
 
 	if (e1 == 0) {
 		if (*value)
@@ -1547,7 +1543,9 @@ PF_setinfokey (progs_t *pr)
 		else
 			Info_RemoveKey (localinfo, key);
 	} else if (e1 <= MAX_CLIENTS) {
-		strcpy(oldval, Info_ValueForKey (svs.clients[e1 - 1].userinfo, key));
+		if (sv_setinfo_e->func)
+			oldval = strdup (Info_ValueForKey (svs.clients[e1 - 1].userinfo,
+											   key));
 		Info_SetValueForKey (svs.clients[e1 - 1].userinfo, key, value,
 							 !sv_highchars->int_val);
 		SV_ExtractFromUserinfo (&svs.clients[e1 - 1]);
@@ -1559,6 +1557,8 @@ PF_setinfokey (progs_t *pr)
 								key, oldval,
 								Info_ValueForKey (svs.clients[e1 - 1].userinfo,
 												  key));
+		if (oldval)
+			free (oldval);
 
 		if (Info_FilterForKey (key, client_info_filters)) {
 			MSG_WriteByte (&sv.reliable_datagram, svc_setinfo);