From 6d64d15216cf8e84f7f6c9fed088afabc64297f6 Mon Sep 17 00:00:00 2001
From: James R <justsomejames2@gmail.com>
Date: Sun, 11 Feb 2024 05:35:42 -0800
Subject: [PATCH] Got_Saycmd: copy message content into intermediate buffer

This prevents modifying the original buffer at the cleanup
step as well as potentially writing out of bounds.
---
 src/hu_stuff.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/hu_stuff.c b/src/hu_stuff.c
index 39ccfbb21..74a2a8ff0 100644
--- a/src/hu_stuff.c
+++ b/src/hu_stuff.c
@@ -665,6 +665,7 @@ static void Got_Saycmd(UINT8 **p, INT32 playernum)
 	SINT8 target;
 	UINT8 flags;
 	const char *dispname;
+	char buf[HU_MAXMSGLEN + 1];
 	char *msg;
 	boolean action = false;
 	char *ptr;
@@ -678,8 +679,8 @@ static void Got_Saycmd(UINT8 **p, INT32 playernum)
 	target = READSINT8(*p);
 	flags = READUINT8(*p);
 	playernum = READUINT8(*p);
-	msg = (char *)*p;
-	SKIPSTRINGL(*p, HU_MAXMSGLEN + 1);
+	msg = buf;
+	READSTRINGL(*p, msg, HU_MAXMSGLEN + 1);
 
 	//check for invalid characters (0x80 or above)
 	{