From af617bc0e6f068208385e6ce092d3a2b0868fe08 Mon Sep 17 00:00:00 2001
From: Zack Middleton <zturtleman@gmail.com>
Date: Mon, 12 Jan 2015 21:24:28 -0600
Subject: [PATCH] Fix possible levelPicNames buffer overflow in q3_ui

---
 code/q3_ui/ui_splevel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/code/q3_ui/ui_splevel.c b/code/q3_ui/ui_splevel.c
index d916a536..a23ef0c6 100644
--- a/code/q3_ui/ui_splevel.c
+++ b/code/q3_ui/ui_splevel.c
@@ -236,7 +236,7 @@ static void UI_SPLevelMenu_SetMenuArena( int n, int level, const char *arenaInfo
 		levelMenuInfo.levelScores[n] = 8;
 	}
 
-	strcpy( levelMenuInfo.levelPicNames[n], va( "levelshots/%s.tga", map ) );
+	Com_sprintf( levelMenuInfo.levelPicNames[n], sizeof(levelMenuInfo.levelPicNames[n]), "levelshots/%s.tga", map );
 	if( !trap_R_RegisterShaderNoMip( levelMenuInfo.levelPicNames[n] ) ) {
 		strcpy( levelMenuInfo.levelPicNames[n], ART_MAP_UNKNOWN );
 	}