Fixed 2 potential buffer overflows in SearchInfostring

[xonotic/darkplaces.git] / common.c

diff --git a/common.c b/common.c
index 6e24a2385786169aaec17fdc42faea0027d8f54b..4ff60bb9d4c9fd97bb5ca0acd82315c5f84efe1a 100644 (file)
--- a/common.c
+++ b/common.c
@@ -219,7 +219,7 @@ void MSG_WriteString (sizebuf_t *sb, const char *s)
                SZ_Write (sb, s, strlen(s)+1);
 }
 
-// used by server (always latest dpprotocol)
+// used by server (always latest PROTOCOL_DARKPLACES)
 void MSG_WriteDPCoord (sizebuf_t *sb, float f)
 {
        if (f >= 0)
@@ -353,7 +353,7 @@ int MSG_ReadBytes (int numbytes, unsigned char *out)
        return l;
 }
 
-// used by server (always latest dpprotocol)
+// used by server (always latest PROTOCOL_DARKPLACES)
 float MSG_ReadDPCoord (void)
 {
        return (signed short) MSG_ReadLittleShort();
@@ -362,9 +362,9 @@ float MSG_ReadDPCoord (void)
 // used by client
 float MSG_ReadCoord (void)
 {
-       if (dpprotocol == DPPROTOCOL_VERSION2 || dpprotocol == DPPROTOCOL_VERSION3)
+       if (cl.protocol == PROTOCOL_DARKPLACES2 || cl.protocol == PROTOCOL_DARKPLACES3 || cl.protocol == PROTOCOL_DARKPLACES4)
                return (signed short) MSG_ReadLittleShort();
-       else if (dpprotocol == DPPROTOCOL_VERSION1)
+       else if (cl.protocol == PROTOCOL_DARKPLACES1)
                return MSG_ReadLittleFloat();
        else
                return MSG_ReadLittleShort() * (1.0f/8.0f);
@@ -506,7 +506,7 @@ COM_ParseToken
 Parse a token out of a string
 ==============
 */
-int COM_ParseToken (const char **datapointer)
+int COM_ParseToken(const char **datapointer, int returnnewline)
 {
        int c;
        int len;
@@ -523,7 +523,7 @@ int COM_ParseToken (const char **datapointer)
 
 // skip whitespace
 skipwhite:
-       while ((c = *data) <= ' ')
+       while ((c = *data) <= ' ' && (c != '\n' || !returnnewline))
        {
                if (c == 0)
                {
@@ -534,15 +534,25 @@ skipwhite:
                data++;
        }
 
-// skip // comments
-       if (c=='/' && data[1] == '/')
+       // check if it's a comment
+       if (c == '/')
        {
-               while (*data && *data != '\n')
-                       data++;
-               goto skipwhite;
+               // skip // comments
+               if (data[1] == '/')
+               {
+                       while (*data && *data != '\n')
+                               data++;
+                       goto skipwhite;
+               }
+               // skip /* comments
+               if (data[1] == '*')
+               {
+                       while (*data && *data != '*' && data[1] != '/')
+                               data++;
+                       goto skipwhite;
+               }
        }
 
-
 // handle quoted strings specially
        if (c == '\"')
        {
@@ -550,7 +560,7 @@ skipwhite:
                while (1)
                {
                        c = *data++;
-                       if (c=='\"' || !c)
+                       if (c == '\"' || !c)
                        {
                                com_token[len] = 0;
                                *datapointer = data;
@@ -562,7 +572,7 @@ skipwhite:
        }
 
 // parse single characters
-       if (c=='{' || c=='}'|| c==')'|| c=='(' || c=='\'' || c==':')
+       if (c == '{' || c == '}' || c == ')' || c == '(' || c == ']' || c == '[' || c == '\'' || c == ':' || c == ',' || c == ';' || c == '\n')
        {
                com_token[len] = c;
                len++;
@@ -578,7 +588,7 @@ skipwhite:
                data++;
                len++;
                c = *data;
-               if (c=='{' || c=='}'|| c==')'|| c=='(' || c=='\'' || c==':')
+               if (c == '{' || c == '}' || c == ')' || c == '(' || c == ']' || c == '[' || c == '\'' || c == ':' || c == ',' || c == ';')
                        break;
        } while (c>32);
 
@@ -682,6 +692,10 @@ void COM_InitGameType (void)
                gamemode = GAME_GOODVSBAD2;
        else if (strstr(name, "teu"))
                gamemode = GAME_TEU;
+       else if (strstr(name, "battlemech"))
+               gamemode = GAME_BATTLEMECH;
+       else if (strstr(name, "zymotic"))
+               gamemode = GAME_ZYMOTIC;
        else
                gamemode = GAME_NORMAL;
 
@@ -701,6 +715,10 @@ void COM_InitGameType (void)
                gamemode = GAME_GOODVSBAD2;
        else if (COM_CheckParm ("-teu"))
                gamemode = GAME_TEU;
+       else if (COM_CheckParm ("-battlemech"))
+               gamemode = GAME_BATTLEMECH;
+       else if (COM_CheckParm ("-zymotic"))
+               gamemode = GAME_ZYMOTIC;
 
        switch(gamemode)
        {
@@ -734,7 +752,15 @@ void COM_InitGameType (void)
                break;
        case GAME_TEU:
                gamename = "TheEvilUnleashed";
-               gamedirname = "teu";
+               gamedirname = "baseteu";
+               break;
+       case GAME_BATTLEMECH:
+               gamename = "Battlemech";
+               gamedirname = "base";
+               break;
+       case GAME_ZYMOTIC:
+               gamename = "Zymotic";
+               gamedirname = "data";
                break;
        default:
                Sys_Error("COM_InitGameType: unknown gamemode %i\n", gamemode);
@@ -872,7 +898,7 @@ char *SearchInfostring(const char *infostring, const char *key)
 
                        if (c == '\0')
                                return NULL;
-                       if (c == '\\')
+                       if (c == '\\' || key_ind == sizeof (crt_key) - 1)
                        {
                                crt_key[key_ind] = '\0';
                                break;
@@ -888,7 +914,7 @@ char *SearchInfostring(const char *infostring, const char *key)
                        {
                                c = *infostring++;
 
-                               if (c == '\0' || c == '\\')
+                               if (c == '\0' || c == '\\' || value_ind == sizeof (value) - 1)
                                {
                                        value[value_ind] = '\0';
                                        return value;