Bug 5051 - Q_strncpyz with destsize < 1 can happen in GraphicsOptions_GetAspectRatios of ui_video.c
Status: RESOLVED FIXED
Alias: None
Product: ioquake3
Classification: Unclassified
Component: Misc
Version: unspecified
Hardware: All All
: P3 normal
Assignee: Zachary J. Slater
QA Contact: ioquake3 bugzilla mailing list
URL:
Depends on:
Blocks:
 
Reported: 2011-06-19 02:25 EDT by ensiform
Modified: 2011-06-24 09:11:23 EDT
1 user (show)

See Also:


Attachments
Fix for overflowing memory in GraphicsOptions_GetAspectRatios (1.68 KB, patch)
2011-06-22 22:21 EDT, ensiform

Description ensiform 2011-06-19 02:25:27 EDT
If you open and close the system menu several times then try to reopen it, the line x = strchr( resolutions[r], 'x' ) + 1; can/will be a null pointer and thus the following line of Q_strncpyz( str, resolutions[r], x-resolutions[r] ); results in a destsize being < 1.
Comment 1 ensiform 2011-06-19 02:26:00 EDT
It's just an error, but a bit annoying when it happens.
Comment 2 ensiform 2011-06-19 12:45:38 EDT
I'm not sure if this can happen in qvm, shared object for sure.
Comment 3 Thilo Schulz 2011-06-21 07:46:03 EDT
I couldn't reproduce it, but I added a fix that should take care of it in r2048
Comment 4 ensiform 2011-06-22 22:21:43 EDT
Created attachment 2794 [details]
Fix for overflowing memory in GraphicsOptions_GetAspectRatios

This patch goes to my quake3++ friend/owner, Roughael.

Why code was broken/needed fixing:

"After the ratios had been calculated, some ratios would have been replaced with known ratios.
this would modify the original ratioBuf value. So the next time GraphicsOptions_GetAspectRatios was called and a ratio was calculated,
it would check if the ratio was already in the list, but it couldn't find it, since it had been replaced by the known ratio.
When this happened a few times, it would overflow ratioBuf by going beyond MAX_RESOLUTIONS, writing into other memory"
Comment 5 ensiform 2011-06-22 22:23:11 EDT
Above attachment and comment.
Comment 6 Thilo Schulz 2011-06-24 09:11:23 EDT
Good spot. Applied, r2055