From 10abac8fa03e8a019dbe3ce8d1de544f1a25102a Mon Sep 17 00:00:00 2001
From: Zack Middleton <zack@cloemail.com>
Date: Sun, 6 May 2018 01:39:20 -0500
Subject: [PATCH] Fix duplicate bots displayed in Team Arena ingame add bot
 menu

The key handler allowed going 2 beyond the end of the bot list and the
display function clamped to 0 causing the first bot to be shown 3 times.

Attempting to add the bot in gametypes < GT_TEAM would fallback to
Sarge in UI_GetBotNameByNumber() (who isn't the first bot) and gametypes
>= GT_TEAM would access characterList past known values (typically NULL
but if teaminfo.txt contained 63 characters it would access out of
bounds memory).
---
 code/ui/ui_main.c | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/code/ui/ui_main.c b/code/ui/ui_main.c
index f83de0be..446be087 100644
--- a/code/ui/ui_main.c
+++ b/code/ui/ui_main.c
@@ -1751,16 +1751,10 @@ static int UI_OwnerDrawWidth(int ownerDraw, float scale) {
 static void UI_DrawBotName(rectDef_t *rect, float scale, vec4_t color, int textStyle) {
 	int value = uiInfo.botIndex;
 	int game = trap_Cvar_VariableValue("g_gametype");
-	const char *text = "";
+	const char *text;
 	if (game >= GT_TEAM) {
-		if (value >= uiInfo.characterCount) {
-			value = 0;
-		}
 		text = uiInfo.characterList[value].name;
 	} else {
-		if (value >= UI_GetNumBots()) {
-			value = 0;
-		}
 		text = UI_GetBotNameByNumber(value);
 	}
   Text_Paint(rect->x, rect->y, scale, color, text, 0, 0, textStyle);
@@ -2548,16 +2542,16 @@ static qboolean UI_BotName_HandleKey(int flags, float *special, int key) {
 		value += select;
 
 		if (game >= GT_TEAM) {
-			if (value >= uiInfo.characterCount + 2) {
+			if (value >= uiInfo.characterCount) {
 				value = 0;
 			} else if (value < 0) {
-				value = uiInfo.characterCount + 2 - 1;
+				value = uiInfo.characterCount - 1;
 			}
 		} else {
-			if (value >= UI_GetNumBots() + 2) {
+			if (value >= UI_GetNumBots()) {
 				value = 0;
 			} else if (value < 0) {
-				value = UI_GetNumBots() + 2 - 1;
+				value = UI_GetNumBots() - 1;
 			}
 		}
 		uiInfo.botIndex = value;