From 2e3963fd16f1cfe435ef1eb3d4a57ccce53021e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gustaf=20Alh=C3=A4ll?= Date: Sun, 2 Apr 2023 21:58:42 +0200 Subject: [PATCH] Fix buffer overflow for setcontrol with 2 arguments --- src/g_input.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/g_input.c b/src/g_input.c index 9d5656253..826dcecbd 100644 --- a/src/g_input.c +++ b/src/g_input.c @@ -993,7 +993,7 @@ static void setcontrol(INT32 (*gc)[2]) { INT32 numctrl; const char *namectrl; - INT32 keynum, keynum1, keynum2; + INT32 keynum, keynum1, keynum2 = 0; INT32 player = ((void*)gc == (void*)&gamecontrolbis ? 1 : 0); boolean nestedoverride = false; @@ -1009,7 +1009,8 @@ static void setcontrol(INT32 (*gc)[2]) return; } keynum1 = G_KeyNameToNum(COM_Argv(2)); - keynum2 = G_KeyNameToNum(COM_Argv(3)); + if (COM_Argc() > 3) + keynum2 = G_KeyNameToNum(COM_Argv(3)); keynum = G_FilterKeyByVersion(numctrl, 0, player, &keynum1, &keynum2, &nestedoverride); if (keynum >= 0)