From d61eb7edeeded1c230148b3b6742a47fe508a80f Mon Sep 17 00:00:00 2001
From: mazmazz <mar.marcoz@outlook.com>
Date: Mon, 31 Dec 2018 01:26:25 -0500
Subject: [PATCH] Increase ChangeControl text buffer to resolve buffer overflow
with System Menu/GIF control config
---
src/m_menu.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/src/m_menu.c b/src/m_menu.c
index 266bc2516..16015078c 100644
--- a/src/m_menu.c
+++ b/src/m_menu.c
@@ -7516,7 +7516,7 @@ static void M_DrawControl(void)
}
static INT32 controltochange;
-static char controltochangetext[55];
+static char controltochangetext[33];
static void M_ChangecontrolResponse(event_t *ev)
{
@@ -7588,7 +7588,8 @@ static void M_ChangecontrolResponse(event_t *ev)
}
else if (ch == KEY_PAUSE)
{
- static char tmp[155];
+ // This buffer assumes a 100-character message plus a 32-character control name (per controltochangetext buffer size)
+ static char tmp[133];
menu_t *prev = currentMenu->prevMenu;
if (controltochange == gc_pause)
@@ -7612,12 +7613,14 @@ static void M_ChangecontrolResponse(event_t *ev)
static void M_ChangeControl(INT32 choice)
{
- static char tmp[55];
+ // This buffer assumes a 35-character message (per below) plus a max control name limit of 32 chars (per controltochangetext)
+ // If you change the below message, then change the size of this buffer!
+ static char tmp[68];
controltochange = currentMenu->menuitems[choice].alphaKey;
sprintf(tmp, M_GetText("Hit the new key for\n%s\nESC for Cancel"),
currentMenu->menuitems[choice].text);
- strncpy(controltochangetext, currentMenu->menuitems[choice].text, 55);
+ strlcpy(controltochangetext, currentMenu->menuitems[choice].text, 33);
M_StartMessage(tmp, M_ChangecontrolResponse, MM_EVENTHANDLER);
}