Fixed 2 potential buffer overflows in SearchInfostring

[xonotic/darkplaces.git] / common.c

diff --git a/common.c b/common.c
index 5318c14ac79771e476a0c3e71be41a288bc8e409..4ff60bb9d4c9fd97bb5ca0acd82315c5f84efe1a 100644 (file)
--- a/common.c
+++ b/common.c
@@ -694,6 +694,8 @@ void COM_InitGameType (void)
                gamemode = GAME_TEU;
        else if (strstr(name, "battlemech"))
                gamemode = GAME_BATTLEMECH;
+       else if (strstr(name, "zymotic"))
+               gamemode = GAME_ZYMOTIC;
        else
                gamemode = GAME_NORMAL;
 
@@ -715,6 +717,8 @@ void COM_InitGameType (void)
                gamemode = GAME_TEU;
        else if (COM_CheckParm ("-battlemech"))
                gamemode = GAME_BATTLEMECH;
+       else if (COM_CheckParm ("-zymotic"))
+               gamemode = GAME_ZYMOTIC;
 
        switch(gamemode)
        {
@@ -754,6 +758,10 @@ void COM_InitGameType (void)
                gamename = "Battlemech";
                gamedirname = "base";
                break;
+       case GAME_ZYMOTIC:
+               gamename = "Zymotic";
+               gamedirname = "data";
+               break;
        default:
                Sys_Error("COM_InitGameType: unknown gamemode %i\n", gamemode);
                break;
@@ -890,7 +898,7 @@ char *SearchInfostring(const char *infostring, const char *key)
 
                        if (c == '\0')
                                return NULL;
-                       if (c == '\\')
+                       if (c == '\\' || key_ind == sizeof (crt_key) - 1)
                        {
                                crt_key[key_ind] = '\0';
                                break;
@@ -906,7 +914,7 @@ char *SearchInfostring(const char *infostring, const char *key)
                        {
                                c = *infostring++;
 
-                               if (c == '\0' || c == '\\')
+                               if (c == '\0' || c == '\\' || value_ind == sizeof (value) - 1)
                                {
                                        value[value_ind] = '\0';
                                        return value;