From f8618d2ed6c131d7c2a502c26f4a5f875899ae74 Mon Sep 17 00:00:00 2001 From: Zack Middleton Date: Sun, 25 May 2014 18:44:17 -0500 Subject: Fix potential buffer overflow caused by long tcMod args Found by Coverity. --- src/renderergl1/tr_shader.c | 4 ++-- src/renderergl2/tr_shader.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/renderergl1/tr_shader.c b/src/renderergl1/tr_shader.c index 116eee94..c44925a8 100644 --- a/src/renderergl1/tr_shader.c +++ b/src/renderergl1/tr_shader.c @@ -1011,8 +1011,8 @@ static qboolean ParseStage( shaderStage_t *stage, char **text ) token = COM_ParseExt( text, qfalse ); if ( token[0] == 0 ) break; - strcat( buffer, token ); - strcat( buffer, " " ); + Q_strcat( buffer, sizeof (buffer), token ); + Q_strcat( buffer, sizeof (buffer), " " ); } ParseTexMod( buffer, stage ); diff --git a/src/renderergl2/tr_shader.c b/src/renderergl2/tr_shader.c index afc8d80d..1c7e452c 100644 --- a/src/renderergl2/tr_shader.c +++ b/src/renderergl2/tr_shader.c @@ -1266,8 +1266,8 @@ static qboolean ParseStage( shaderStage_t *stage, char **text ) token = COM_ParseExt( text, qfalse ); if ( token[0] == 0 ) break; - strcat( buffer, token ); - strcat( buffer, " " ); + Q_strcat( buffer, sizeof (buffer), token ); + Q_strcat( buffer, sizeof (buffer), " " ); } ParseTexMod( buffer, stage ); -- cgit