fix some potential buffer overflows

git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@5377 d7cf8633-e32d-0410-b094-e92efae38249

diff --git a/cl_screen.c b/cl_screen.c
index 7ccced756461997a95e89382103ffc63d1ecec2b..650c64dce2b281e9c7390dda05a00e17f5116614 100644 (file)
--- a/cl_screen.c
+++ b/cl_screen.c
@@ -324,25 +324,25 @@ void R_TimeReport(char *desc)
        r_timereport_current = Sys_DoubleTime();
        t = (int) ((r_timereport_current - r_timereport_temp) * 1000000.0);
 
-       sprintf(tempbuf, "%8i %s", t, desc);
+       dpsnprintf(tempbuf, sizeof(tempbuf), "%8i %s", t, desc);
        length = strlen(tempbuf);
        while (length < 20)
                tempbuf[length++] = ' ';
        tempbuf[length] = 0;
        if (speedstringcount + length > (vid_conwidth.integer / 8))
        {
-               strcat(r_speeds_string, "\n");
+               strlcat(r_speeds_string, "\n", sizeof(r_speeds_string));
                speedstringcount = 0;
        }
        // skip the space at the beginning if it's the first on the line
        if (speedstringcount == 0)
        {
-               strcat(r_speeds_string, tempbuf + 1);
+               strlcat(r_speeds_string, tempbuf + 1, sizeof(r_speeds_string));
                speedstringcount = length - 1;
        }
        else
        {
-               strcat(r_speeds_string, tempbuf);
+               strlcat(r_speeds_string, tempbuf, sizeof(r_speeds_string));
                speedstringcount += length;
        }
 }

diff --git a/gl_draw.c b/gl_draw.c
index 135cac695bd347c4f7d3c32c8c7c72fd5c779fbd..fc19b76fb1fa069882e44ef50f7f43078668812b 100644 (file)
--- a/gl_draw.c
+++ b/gl_draw.c
@@ -292,7 +292,7 @@ cachepic_t  *Draw_CachePic (const char *path, qboolean persistent)
        if (numcachepics == MAX_CACHED_PICS)
                Sys_Error ("numcachepics == MAX_CACHED_PICS");
        pic = cachepics + (numcachepics++);
-       strcpy (pic->name, path);
+       strlcpy (pic->name, path, sizeof(pic->name));
        // link into list
        pic->chain = cachepichash[hashkey];
        cachepichash[hashkey] = pic;