From f3f3fafdc4f19f7289801614ee779cabf2f92a13 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gustaf=20Alh=C3=A4ll?= Date: Sat, 4 Jan 2025 18:27:11 +0100 Subject: [PATCH] Fix buffer overflow when reading string from R_TextureNameForNum into Lua --- src/lua_baselib.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/lua_baselib.c b/src/lua_baselib.c index 19775eb8a..18ae53405 100644 --- a/src/lua_baselib.c +++ b/src/lua_baselib.c @@ -3181,17 +3181,25 @@ static int lib_rTextureNumForName(lua_State *L) static int lib_rCheckTextureNameForNum(lua_State *L) { + char s[9]; INT32 num = (INT32)luaL_checkinteger(L, 1); //HUDSAFE - lua_pushstring(L, R_CheckTextureNameForNum(num)); + + M_Memcpy(s, R_CheckTextureNameForNum(num), 8); + s[8] = '\0'; + lua_pushstring(L, s); return 1; } static int lib_rTextureNameForNum(lua_State *L) { + char s[9]; INT32 num = (INT32)luaL_checkinteger(L, 1); //HUDSAFE - lua_pushstring(L, R_TextureNameForNum(num)); + + M_Memcpy(s, R_TextureNameForNum(num), 8); + s[8] = '\0'; + lua_pushstring(L, s); return 1; }