qcommon: fix potential buffer overflow in COM_StripFilename

src/cgame/cg_sound.c

@@ -1327,7 +1327,7 @@ qboolean CG_SpeakerEditor_NoiseEdit_KeyDown(panel_button_t *button, int key)
 			int  i, numfiles, filelen;
 			char *fileptr;
 
-			COM_StripFilename(button->text, dirname);
+			COM_StripFilename(button->text, dirname, sizeof(dirname));
 			Q_strncpyz(filename, COM_SkipPath(button->text), sizeof(filename));
 
 			if (!Q_stricmp(button->text, dirname))

src/qcommon/q_shared.c

@@ -81,17 +81,16 @@ void COM_FixPath(char *pathname)
  */
 char *COM_SkipPath(char *pathname)
 {
-	char *last = pathname;
+	char *last = strrchr(pathname, '/');
 
-	while (*pathname)
+	if (last)
 	{
-		if (*pathname == '/')
-		{
-			last = pathname + 1;
-		}
-		pathname++;
+		return last + 1;
+	}
+	else
+	{
+		return pathname;
 	}
-	return last;
 }
 
 /**
@@ -166,11 +165,11 @@ qboolean COM_CompareExtension(const char *in, const char *ext)
  * @param[in] in
  * @param[out] out
  */
-void COM_StripFilename(const char *in, char *out)
+void COM_StripFilename(const char *in, char *out, size_t outsize)
 {
 	char *end;
 
-	Q_strncpyz(out, in, strlen(in) + 1);
+	Q_strncpyz(out, in, outsize);
 	end  = COM_SkipPath(out);
 	*end = 0;
 }

src/qcommon/q_shared.h

@@ -610,7 +610,7 @@ void COM_FixPath(char *pathname);
 const char *COM_GetExtension(const char *name);
 void COM_StripExtension(const char *in, char *out, int destsize);
 qboolean COM_CompareExtension(const char *in, const char *ext);
-void COM_StripFilename(const char *in, char *out);
+void COM_StripFilename(const char *in, char *out, size_t outsize);
 
 void COM_DefaultExtension(char *path, size_t maxSize, const char *extension);