Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Buffer overflow in CHudMessage::MessageDrawScan #3705

Open
tmp64 opened this issue Dec 12, 2023 · 1 comment
Open

Buffer overflow in CHudMessage::MessageDrawScan #3705

tmp64 opened this issue Dec 12, 2023 · 1 comment

Comments

@tmp64
Copy link

tmp64 commented Dec 12, 2023

CHudMessage::MessageDrawScan doesn't check the length of the line when filling the line buffer.

halflife/cl_dll/message.cpp

Lines 286 to 297 in c7240b9

m_parms.lineLength = 0;
m_parms.width = 0;
while ( *pText && *pText != '\n' )
{
unsigned char c = *pText;
line[m_parms.lineLength] = c;
m_parms.width += gHUD.m_scrinfo.charWidths[c];
m_parms.lineLength++;
pText++;
}
pText++; // Skip LF
line[m_parms.lineLength] = 0;

The recent compiler update enabled security checks so a text line longer than 79 characters will cause all Windows clients to crash (tmp64/BugfixedHL-Rebased#195).

This bug only affects HL, DMC, Ricochet, Opposing Force and TFC. It was fixed in CS1.6, CSCZ, Blue Shift and DOD.

@stylez1989
Copy link

Seems to happen on the AG.DLL but less aggressively than bugfixedHL.DLL Be nice to get this fixed for Half-life

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants