Windows API ignores all trailing spaces and periods which can get around
Quake 3 file system restrictions. QVM opening 'uix86.dll.' actually
opens 'uix86.dll' which allows QVM to write native code.
This is done in the low-level Sys_FOpen() instead of the function
directly used by VMs ( FS_FOpenFileByMode() ) in case there are engine
commands now or in the future that can read or write arbitrary files.
Reported by Noah Metzger (Chomenor).
* Don't try to embed manifest (it causes build to fail because it's
specified in win_resource.rc).
* Fix curl include path.
* Compile sys_autoupdater.c.
* Make quake3 debug link to msvcrtd.lib instead of msvcrt.lib to fix
unresolved external symbol __imp___CrtDbgReportW.
* Fix q3_ui dll output directory.
* Fix opus path filter.
* Use UseOfMfc false and CharacterSet NotSet.
* Fix header paths and remove non-existent files.
My cvar latch system changes prevent the Game VM from changing
g_gametype when the value is out of range due to it being registed in
the engine. It's been pointed out as fragile method of security, which
was still exploitable, by Noah Metzger (Chomenor). It doesn't seem like
this is working out to be a good solution.
The issue of fs_game '..' on server being relicated on client via
systeminfo exploit is still fixed as it's not affected by latch.
There are a few cases from current values of fs_game are used which
ideally should use fs_gamedir char array which has been validated.
Revert "Don't let VMs change engine latch cvars immediately"
Partially revert "Fix fs_game '..' reading outside of home and base path"
Revert "Fix VMs forcing engine latch cvar to update to latched value"
A few commits ago I stopped VM's Cvar_Set() from instantly updating
latched values. Now VM can't call Cvar_Register() afterword to force
latched value to be used.
Reported by Noah Metzger (Chomenor).
VMs could set fs_game to '..' at anytime to access files outside of home
and base path. fs_game sent by server to clients could also be '..' to
access files outside of home and base path.
'..' was not caught by FS_CheckDirTraversal() as it expects filenames
not a single directory.
I've made fs_game be latched to prevent VMs from changing it with no
good way to validate it before it's used. com_basegame and fs_basegame
are now latched as well.
Additionally, it's now possible to change com_basegame while the engine
is running. game_restart or vid_restart will make it take affect.
com_homepath is now CVAR_PROTECTED to prevent VMs from changing it
to a directory traversal.
This requires my two previous commits for preventing VMs from changing
engine latch cvars and only Cvar_Get fs_game in FS_Startup (so CVAR_INIT
isn't added in serveral other places).
Reported by Noah Metzger (Chomenor).
If a VM increases sv_maxclients while a server is running the engine
will crash. The value should be latched until engine decides to update
the cvar; the same as when a user sets it.
VM could use Cvar_Register to set a protected cvar as user created and
was then able to use Cvar_Register with CVAR_ROM to change the value.
Don't allow Cvar_Register to affect protected cvars and prevent VMs
from adding internal flags to any cvars (creator, modified, protected,
nonexistent).
Reported by Noah Metzger (Chomenor).
There was an extra plus sign in Huff_Compress(). It wasn't causing any
issues as it does not affect the generated code. Removing it makes the
source code the same as Huff_Decompress().
The odd source code was brought to my attention by Tobias Kuehnhammer.
It seems to improve framerate and still work on x86 and x86_64. I
haven't tested ppc64 as I don't have the hardware. ppc64 isn't built
into the universal bundle either.
I noticed this because compiling opus warns it may be slow due to
optimization being disabled.
Use opengl1 renderer behavior of adding fixed amount of ambient light
to all models regardless of HDR setting. It fixes the view weapon
having zero ambient light on pillcity map.
Models for Team Arena's holdable medkit and invulnerability effects use
the frames numbers from the player's torso but the actual models only
have one frame (0).
In no particular order:
* Use `set -e`, because it prevents accidents, and means we can avoid
lengthy &&-joined command chains.
* Override defaults by setting env vars; this means people don't have to
edit the script to change things.
* Use an unpredictable and safely-created tmpdir for building; ain't nobody
wants to cleanup from a tmpdir race condition attack.
* Test for the presence of `git` and `make` *before* asking questions, and
only prompt the user about them if they're missing. No need to bother
people with unnecessary reading.
* Automatically clean up the build directory after use.
* Tidy up some indenting that had come asunder.
Gauntlet and Grappling Hook use -1 ammo. Gauntlet is excluded from
the check ammo loop but Grappling Hook causes ammo time remaining
to decrease 200 milliseconds.
The out of ammo check tests time remaining is equal to zero. This
means carrying Grappling Hook and out of ammo will have negative
time remaining which results in the low ammo message being displayed
instead of out of ammo.
OpenBSD's sed (and possibly other platforms') interprets `\r` as a
literal `r` rather than a carriage return, which leads to all `r`
letters being stripped from the shaders' source.
This fixes the issue by using the POSIX-compliant `tr -d '\r'` to remove
carriage returns.
Thanks to @ryan-sg for reporting the issue
A race condition can happen when running "make all" with parallel jobs.
The issue is that the build directory can be created by another
concurrent job between the moment it was detected as missing and the
moment mkdir is called (which fails if the directory already exists).
This fixes the problem by always using `mkdir -p` which doesn't fail if
the directory already exists.
The game world is too dark when r_autoExposure is disabled. It can be
fixed by setting (cheat) r_cameraExposure to 1 but then the game is
too bright when r_autoExposure is enabled. So default r_cameraExposure
to 1 and make auto exposure subtract 1 from r_cameraExposure value.
The use of signed types in these expressions lead to overflow, hence undefined behaviour. The "sum" aggregator in Com_TouchMemory isn't even used (and presumbably just exists to inhibit optimizations from removing the memory access).
SDL_CFLAGS and SDL_LIBS assignment was "only if absent". However due
to previously assigning them to "pkg-config sdl2" values, the values
from sdl2-config were ignored.
- Parse OpenGL version in sdl_glimp.c to share with both renderers.
- Add GL_VERSION_ATLEAST(major, minor) macro.
- Get address of glGetStringi if using OpenGL 3.
- Fix glConfig.extensions_string when using GL3 core context in
opengl2 renderer.
- Make opengl1 renderer's gfxinfo support qglGetStringi too.
Get all OpenGL functions using SDL_GL_GetProcAddress(). This makes it
easier to cross-arch compile on Linux and add support for OpenGL ES
in the future.
Users still have to supply their own libSDL2 for cross-arch compiling
on Linux. But now the user does not have to re-install libgl1-mesa-dev
package for i386 or amd64 on Debian when switching between compiling
ioquake3 for x86 and x86_64.
If a lightning bolt killed a player or the first shotgun pellet that
hit a player killed them, the shot was not counted as accurate.
Check if shot player is alive for hit accuracy before dealing damage.
Fix for ioq3 test builds for Windows x86 (cross-compiled from Ubuntu
using mingw-w64) requiring libgcc_s_sjlj-1.dll. I'm unable to reproduce
the issue using mingw-w64 in Debian or Cygwin.
