CBasePlayer::PackDeadPlayerItems can cause buffer overflow when custom gamerules are used

[SamVanheer]

The method CBasePlayer::PackDeadPlayerItems can cause a buffer overflow if a custom gamerules object is used that returns the rule GR_PLR_DROP_GUN_ALL from CGameRules::DeadPlayerWeapons.

The line in question is this one;

halflife/dlls/player.cpp

Line 687 in c7240b9

CBasePlayerWeapon *rgpPackWeapons[ 20 ];// 20 hardcoded for now. How to determine exactly how many weapons we have?

If the player has more than 20 weapons this will overwrite whatever is on the stack after that array.

The simplest fix is to use the constant MAX_WEAPONS instead of 20:

halflife/dlls/cdll_dll.h

Line 23 in c7240b9

#define MAX_WEAPONS 32 // ???

This doesn't affect vanilla Half-Life or Opposing Force, but to prevent mods from introducing such a vulnerability the SDK should definitely be updated.