Back to the Vavoom Forum Archives


Forum

[Fixed] [1.24] double client buffer overflow

Mon, 20 Aug 2007 17:47:17

khlero

Hi. i found 2 bugs in the client: 1) MAP command: COMMAND(Map) { guard(COMMAND Map); char mapname[12]; if (Args.Num() != 2) { GCon->Log("map <mapname> : change level"); return; } VStr::Cpy(mapname, *Args[1]); .... } If you create an alias like: alias mapbug "map AAAAA....AAAA" the client will crash! 2) SCREENSHOT bug: COMMAND(ScreenShot) { guard(COMMAND ScreenShot); int i; int bpp; bool bot2top; void *data; char filename[128]; // Find a file name to save it to VStr BaseDir = (fl_savedir ? fl_savedir : fl_basedir) + "/" + fl_gamedir; for (i = 0; i <= 9999; i++) { sprintf(filename, "shot%04d.%s", i, (constchar*)screenshot_type); .... } if you create an alias like: alias screenbug "screenshot_type AAAA....AAAA" and after type screenshot the client will crash. Thanks Khlero
Wed, 29 Aug 2007 22:11:16

Janis Legzdinsh

Fixed

Back to the Vavoom Forum Archives