From eeeaf3f1252d95a6037f33d30fdf2e945e340f79 Mon Sep 17 00:00:00 2001 From: Zack Middleton Date: Sun, 25 May 2014 18:44:17 -0500 Subject: [PATCH] Fix potential buffer overflow caused by long tcMod args Found by Coverity. --- code/renderergl1/tr_shader.c | 4 ++-- code/renderergl2/tr_shader.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/code/renderergl1/tr_shader.c b/code/renderergl1/tr_shader.c index de3a45c4..103d329f 100644 --- a/code/renderergl1/tr_shader.c +++ b/code/renderergl1/tr_shader.c @@ -1010,8 +1010,8 @@ static qboolean ParseStage( shaderStage_t *stage, char **text ) token = COM_ParseExt( text, qfalse ); if ( token[0] == 0 ) break; - strcat( buffer, token ); - strcat( buffer, " " ); + Q_strcat( buffer, sizeof (buffer), token ); + Q_strcat( buffer, sizeof (buffer), " " ); } ParseTexMod( buffer, stage ); diff --git a/code/renderergl2/tr_shader.c b/code/renderergl2/tr_shader.c index ed8212d2..cbb01121 100644 --- a/code/renderergl2/tr_shader.c +++ b/code/renderergl2/tr_shader.c @@ -1265,8 +1265,8 @@ static qboolean ParseStage( shaderStage_t *stage, char **text ) token = COM_ParseExt( text, qfalse ); if ( token[0] == 0 ) break; - strcat( buffer, token ); - strcat( buffer, " " ); + Q_strcat( buffer, sizeof (buffer), token ); + Q_strcat( buffer, sizeof (buffer), " " ); } ParseTexMod( buffer, stage );