From d76e21b54660c2efec99384538ed90b28eb513e3 Mon Sep 17 00:00:00 2001
From: Inuyasha <MattWCSTRFAN@gmail.com>
Date: Thu, 28 Jan 2016 08:15:34 -0800
Subject: [PATCH] fix bind out of bounds / keystring misreading

---
 src/console.c | 2 +-
 src/g_input.c | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/console.c b/src/console.c
index e77c400b3f..fcac0e6de9 100644
--- a/src/console.c
+++ b/src/console.c
@@ -202,7 +202,7 @@ static void CONS_Bind_f(void)
 	}
 
 	key = G_KeyStringtoNum(COM_Argv(1));
-	if (!key)
+	if (key <= 0 || key >= NUMINPUTS)
 	{
 		CONS_Alert(CONS_NOTICE, M_GetText("Invalid key name\n"));
 		return;
diff --git a/src/g_input.c b/src/g_input.c
index f12ddb7114..79e6fb94b9 100644
--- a/src/g_input.c
+++ b/src/g_input.c
@@ -1042,13 +1042,13 @@ INT32 G_KeyStringtoNum(const char *keystr)
 	if (!keystr[1] && keystr[0] > ' ' && keystr[0] <= 'z')
 		return keystr[0];
 
+	if (!strncmp(keystr, "KEY", 3) && keystr[3] >= '0' && keystr[3] <= '9')
+		return atoi(&keystr[3]);
+
 	for (j = 0; j < NUMKEYNAMES; j++)
 		if (!stricmp(keynames[j].name, keystr))
 			return keynames[j].keynum;
 
-	if (strlen(keystr) > 3)
-		return atoi(&keystr[3]);
-
 	return 0;
 }
 
-- 
GitLab