Got_Saycmd: copy message content into intermediate buffer

This prevents modifying the original buffer at the cleanup
step as well as potentially writing out of bounds.
This commit is contained in:
James R 2024-02-11 05:35:42 -08:00
parent 42bca87c9a
commit 6d64d15216

View file

@ -665,6 +665,7 @@ static void Got_Saycmd(UINT8 **p, INT32 playernum)
SINT8 target;
UINT8 flags;
const char *dispname;
char buf[HU_MAXMSGLEN + 1];
char *msg;
boolean action = false;
char *ptr;
@ -678,8 +679,8 @@ static void Got_Saycmd(UINT8 **p, INT32 playernum)
target = READSINT8(*p);
flags = READUINT8(*p);
playernum = READUINT8(*p);
msg = (char *)*p;
SKIPSTRINGL(*p, HU_MAXMSGLEN + 1);
msg = buf;
READSTRINGL(*p, msg, HU_MAXMSGLEN + 1);
//check for invalid characters (0x80 or above)
{