From 2e3963fd16f1cfe435ef1eb3d4a57ccce53021e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gustaf=20Alh=C3=A4ll?= <gustaf@hanicef.me>
Date: Sun, 2 Apr 2023 21:58:42 +0200
Subject: [PATCH] Fix buffer overflow for setcontrol with 2 arguments
---
src/g_input.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/g_input.c b/src/g_input.c
index 9d5656253..826dcecbd 100644
--- a/src/g_input.c
+++ b/src/g_input.c
@@ -993,7 +993,7 @@ static void setcontrol(INT32 (*gc)[2])
{
INT32 numctrl;
const char *namectrl;
- INT32 keynum, keynum1, keynum2;
+ INT32 keynum, keynum1, keynum2 = 0;
INT32 player = ((void*)gc == (void*)&gamecontrolbis ? 1 : 0);
boolean nestedoverride = false;
@@ -1009,7 +1009,8 @@ static void setcontrol(INT32 (*gc)[2])
return;
}
keynum1 = G_KeyNameToNum(COM_Argv(2));
- keynum2 = G_KeyNameToNum(COM_Argv(3));
+ if (COM_Argc() > 3)
+ keynum2 = G_KeyNameToNum(COM_Argv(3));
keynum = G_FilterKeyByVersion(numctrl, 0, player, &keynum1, &keynum2, &nestedoverride);
if (keynum >= 0)
--
GitLab