prevent string overflow in radiant md2 loader

[xonotic/netradiant.git] / plugins / md3model / md2.cpp

diff --git a/plugins/md3model/md2.cpp b/plugins/md3model/md2.cpp
index e18ef2f6ca68016edf5dccd31f2fda6eb57caaef..a347c5f4909f2b7e20909cd56cd2a6bab781dc46 100644 (file)
--- a/plugins/md3model/md2.cpp
+++ b/plugins/md3model/md2.cpp
@@ -233,7 +233,8 @@ void MD2Surface_read( Model& model, const byte* buffer, ArchiveFile& file ){
 
        char skinname[MD2_MAX_SKINNAME];
        char skinnameRelative[MD2_MAX_SKINNAME];
-       char path[MD2_MAX_SKINNAME];
+       char path[MD2_MAX_SKINNAME + 1];
+       path[MD2_MAX_SKINNAME] = '\0';
        int i = MD2_MAX_SKINNAME;
        PointerInputStream inputStream( buffer + header.ofs_skins );
        inputStream.read( reinterpret_cast<byte*>( skinnameRelative ), MD2_MAX_SKINNAME );
@@ -255,7 +256,8 @@ void MD2Surface_read( Model& model, const byte* buffer, ArchiveFile& file ){
        }
        else
        {
-               strcpy( skinname, skinnameRelative );
+               strncpy( skinname, skinnameRelative, MD2_MAX_SKINNAME - 1 );
+               skinname[MD2_MAX_SKINNAME - 1] = '\0';
        }
        surface.setShader( skinname );
        surface.updateAABB();