Fix unsafe string functions

client/cl_input.c

@@ -302,13 +302,13 @@ void IN_SelectUp(void) {
             num = mn;
             memcpy(selected, merged, sizeof(DWORD) * mn);
         }
-        strcpy(buffer, "select");
+        strlcpy(buffer, "select", sizeof(buffer));
         FOR_LOOP(i, num) {
             size_t used = strlen(buffer);
             snprintf(buffer + used, sizeof(buffer) - used, " %d", selected[i]);
         }
         MSG_WriteByte(&cls.netchan.message, clc_stringcmd);
-        SZ_Printf(&cls.netchan.message, buffer);
+        SZ_Printf(&cls.netchan.message, "%s", buffer);
 
         /* Store selected entities and request UI data (Phase 8.6) */
         cl.selection.num_selected = num;
@@ -320,7 +320,7 @@ void IN_SelectUp(void) {
 void CL_ForwardToServer_f(void) {
     extern LPCSTR current_command;
     MSG_WriteByte(&cls.netchan.message, clc_stringcmd);
-    SZ_Printf(&cls.netchan.message, current_command+4);
+    SZ_Printf(&cls.netchan.message, "%s", current_command+4);
 }
 
 void CL_InitInput(void) {

client/cl_input_w3.c

@@ -48,13 +48,13 @@ static void CL_ApplySelection(DWORD const *ids, DWORD n) {
     char buffer[1024];
     if (n == 0) return;
     if (n > MAX_SELECTED_ENTITIES) n = MAX_SELECTED_ENTITIES;
-    strcpy(buffer, "select");
+    strlcpy(buffer, "select", sizeof(buffer));
     FOR_LOOP(i, n) {
         size_t used = strlen(buffer);
         snprintf(buffer + used, sizeof(buffer) - used, " %d", ids[i]);
     }
     MSG_WriteByte(&cls.netchan.message, clc_stringcmd);
-    SZ_Printf(&cls.netchan.message, buffer);
+    SZ_Printf(&cls.netchan.message, "%s", buffer);
     cl.selection.num_selected = n;
     memcpy(cl.selection.entity_nums, ids, sizeof(DWORD) * n);
     CL_RequestUnitUI(n, cl.selection.entity_nums);

client/cl_layout.c

@@ -107,16 +107,16 @@ LPCSTR SCR_GetStringValue(LPCUIFRAME frame) {
     static char text[1024] = { 0 };
     if (frame->stat >= MAX_STATS) {
         if (cl.playerstate.texts[frame->stat - MAX_STATS]) {
-            strcpy(text, cl.playerstate.texts[frame->stat - MAX_STATS]);
+            strlcpy(text, cl.playerstate.texts[frame->stat - MAX_STATS], sizeof(text));
         } else {
             memset(text, 0, sizeof(text));
         }
     } else if (frame->stat == PLAYERSTATE_RESOURCE_FOOD_USED) {
         DWORD food_used = cl.playerstate.stats[PLAYERSTATE_RESOURCE_FOOD_USED];
         DWORD food_made = cl.playerstate.stats[PLAYERSTATE_RESOURCE_FOOD_CAP];
-        sprintf(text, "%d/%d", food_used, food_made);
+        snprintf(text, sizeof(text), "%d/%d", food_used, food_made);
     } else if (frame->stat > 0) {
-        sprintf(text, "%d", cl.playerstate.stats[frame->stat]);
+        snprintf(text, sizeof(text), "%d", cl.playerstate.stats[frame->stat]);
     } else if (frame->text) {
         return frame->text;
     } else {

client/cl_view.c

@@ -426,8 +426,13 @@ void CL_PrepRefresh(void) {
         PATHSTR portrait = { 0 };
         LPCSTR ext = strstr(filename, ".m");
         if (ext) {
-            memcpy(portrait, filename, ext - filename);
-            sprintf(portrait + strlen(portrait), "_Portrait%s", ext);
+            size_t base_len = (size_t)(ext - filename);
+            if (base_len >= sizeof(portrait)) {
+                base_len = sizeof(portrait) - 1;
+            }
+            memcpy(portrait, filename, base_len);
+            portrait[base_len] = '\0';
+            snprintf(portrait + base_len, sizeof(portrait) - base_len, "_Portrait%s", ext);
         }
         cl.models[i] = re.LoadModel(filename);
         if (!cl.models[i]) {

common/cmd.c

@@ -62,7 +62,7 @@ char *va(char *format, ...) {
     va_list argptr;
     static char string[1024];
     va_start (argptr, format);
-    vsprintf (string, format,argptr);
+    vsnprintf (string, sizeof(string), format,argptr);
     va_end (argptr);
     return string;
 }

common/common.c

@@ -1396,7 +1396,7 @@ void Com_Error(errorCode_t code, LPCSTR fmt, ...) {
     recursive = true;
 
     va_start(argptr,fmt);
-    vsprintf(msg,fmt,argptr);
+    vsnprintf(msg,sizeof(msg),fmt,argptr);
     va_end(argptr);
 
     switch (code) {

common/mpq.c

@@ -309,7 +309,7 @@ static void CacheBlockLookup(MPQ_ARCHIVE *mpq, const char *fileName, DWORD block
         free(entry);
         return;
     }
-    strcpy(entry->name, key);
+    memcpy(entry->name, key, strlen(key) + 1);
     entry->block_index = block_index;
     entry->next = mpq->lookup_cache[hash & (mpq->lookup_cache_size - 1)];
     mpq->lookup_cache[hash & (mpq->lookup_cache_size - 1)] = entry;
@@ -632,7 +632,7 @@ static BOOL WriterAddData(MPQ_ARCHIVE *mpq, const char *archivedName, const BYTE
         mpq->write_count--;
         return FALSE;
     }
-    strcpy(entry->name, path);
+    memcpy(entry->name, path, strlen(path) + 1);
     entry->offset = (DWORD)pos;
     entry->block_size = write_size;
     entry->file_size = size;
@@ -1760,7 +1760,7 @@ static void PreloadListfileCache(MPQ_ARCHIVE *mpq)
         if (!entries[i].name) {
             break;
         }
-        strcpy(entries[i].name, line);
+        memcpy(entries[i].name, line, strlen(line) + 1);
         CanonicalizeMpqKey(entries[i].name, entries[i].name, strlen(entries[i].name) + 1);
         entries[i].hash1 = HashString(entries[i].name, MPQ_HASH_NAME_A);
         entries[i].hash2 = HashString(entries[i].name, MPQ_HASH_NAME_B);
@@ -1989,7 +1989,7 @@ static BOOL AppendFindListEntry(MPQ_FIND *find, const char *name)
         return FALSE;
     }
 
-    strcpy(copy, name);
+    memcpy(copy, name, strlen(name) + 1);
     find->files = next;
     find->files[find->file_count++] = copy;
     return TRUE;

common/msg.c

@@ -437,9 +437,26 @@ void MSG_ReadDeltaPlayerState(LPSIZEBUF msg,
 
 void SZ_Printf(LPSIZEBUF msg, LPCSTR fmt, ...) {
     va_list argptr;
+    int written;
+
+    if (msg->cursize >= msg->maxsize) {
+        msg->overflowed = true;
+        return;
+    }
+
     va_start(argptr, fmt);
-    msg->cursize += vsprintf((LPSTR)(msg->data + msg->cursize), fmt, argptr) + 1;
+    written = vsnprintf((LPSTR)(msg->data + msg->cursize), msg->maxsize - msg->cursize, fmt, argptr);
     va_end(argptr);
+
+    if (written < 0 || (DWORD)written >= msg->maxsize - msg->cursize) {
+        fprintf(stderr,
+                "Write buffer overflow (msg): maxsize=%u cursize=%u\n",
+                (unsigned)msg->maxsize,
+                (unsigned)msg->cursize);
+        msg->overflowed = true;
+        return;
+    }
+    msg->cursize += written + 1;
 }
 
 void MSG_WriteEntityBits(LPSIZEBUF buf, DWORD bits, DWORD number) {

games/starcraft-2/common/world_sc2.c

@@ -23,7 +23,7 @@ bool CM_LoadMapFormat(LPCSTR mapFilename) {
     world.map->height = height + 1;
     world.map->center = map->origin;
     world.info.mapName = MemAlloc(strlen(map->map_name) + 1);
-    strcpy(world.info.mapName, map->map_name);
+    memcpy(world.info.mapName, map->map_name, strlen(map->map_name) + 1);
     world.info.playableArea.width = width;
     world.info.playableArea.height = height;
     world.info.players[0].used = true;

games/starcraft-2/game/g_model.c

@@ -158,10 +158,10 @@ static BYTE *ReadModelFile(LPCSTR filename, DWORD *out_size) {
 
         if (len == 0 || len >= sizeof(path))
             return NULL;
-        strcpy(path, filename);
+        memcpy(path, filename, len + 1);
         ext = strstr(path, ".m3");
-        if (ext && ext[3] == '\0') {
-            strcpy(ext, ".m3x");
+        if (ext && ext[3] == '\0' && (size_t)(ext - path) + 5 <= sizeof(path)) {
+            memcpy(ext, ".m3x", 5);
             data = gi.ReadFile(path, out_size);
         }
     }

games/warcraft-3/game/api/api_misc.h

@@ -107,13 +107,13 @@ MATH_FUNC(S2R, atoi, string, number);
 DWORD I2S(LPJASS j) {
     LONG i = jass_checkinteger(j, 1);
     char buffer[64] = { 0 };
-    sprintf(buffer, "%d", i);
+    snprintf(buffer, sizeof(buffer), "%d", i);
     return jass_pushstring(j, buffer);
 }
 DWORD R2S(LPJASS j) {
     FLOAT r = jass_checknumber(j, 1);
     char buffer[64] = { 0 };
-    sprintf(buffer, "%f", r);
+    snprintf(buffer, sizeof(buffer), "%f", r);
     return jass_pushstring(j, buffer);
 }
 DWORD R2SW(LPJASS j) {
@@ -769,7 +769,7 @@ DWORD DialogDisplay(LPJASS j) {
 DWORD InitGameCache(LPJASS j) {
     API_ALLOC(ggamecache_t, gamecache);
     LPCSTR campaignFile = jass_checkstring(j, 1);
-    strcpy(gamecache->campaign, campaignFile);
+    strlcpy(gamecache->campaign, campaignFile, sizeof(gamecache->campaign));
     return 1;
 }
 DWORD SaveGameCache(LPJASS j) {

games/warcraft-3/game/api/api_sound.h

@@ -8,7 +8,7 @@ DWORD CreateSound(LPJASS j) {
     LPCSTR eaxSetting = jass_checkstring(j, 7);
     (void)eaxSetting;
     API_ALLOC(gsound_t, sound);
-    strcpy(sound->fileName, fileName);
+    strlcpy(sound->fileName, fileName, sizeof(sound->fileName));
     sound->looping = looping;
     sound->is3D = is3D;
     sound->stopwhenoutofrange = stopwhenoutofrange;

games/warcraft-3/game/g_items.c

@@ -19,7 +19,7 @@ static FLOAT G_MiscVectorValue(LPCSTR name, DWORD index) {
 
 void SP_SpawnItem(LPEDICT self) {
     PATHSTR model_filename;
-    strcpy(model_filename, ITEM_FILE(self->class_id));
+    strlcpy(model_filename, ITEM_FILE(self->class_id), sizeof(model_filename));
     self->s.model = G_RegisterModel(model_filename);
     self->s.shadow = G_LoadShadowTexture(FS_FindSheetCell(game.config.misc, "Misc", "ItemShadowFile"), false);
     self->s.shadow_rect = ShadowPackRect(

games/warcraft-3/game/g_model.c

@@ -19,7 +19,7 @@ static void ConvertMDLXAnimationName(LPANIMATION seq) {
     char buffer[80];
     char *last_char = buffer;
     memset(buffer, 0, sizeof(buffer));
-    strcpy(buffer, seq->name);
+    strlcpy(buffer, seq->name, sizeof(buffer));
     for (char *ch = buffer; *ch; ch++) {
         if (isdigit(*ch) || *ch == '-') {
             while (*(++last_char)) {
@@ -214,7 +214,7 @@ static BYTE *ReadModelFile(LPCSTR filename, DWORD *out_size) {
         size_t len = strlen(filename);
         if (len == 0 || len >= sizeof(path))
             return NULL;
-        strcpy(path, filename);
+        memcpy(path, filename, len + 1);
         path[len - 1] = 'x';
         data = gi.ReadFile(path, out_size);
     }

games/warcraft-3/game/g_monster.c

@@ -398,7 +398,7 @@ void SP_SpawnUnit(LPEDICT self) {
     PATHSTR model_filename;
     LPCSTR uber_splat = UNIT_UBER_SPLAT(self->class_id);
     LPCSTR path_tex = UNIT_PATH_TEX(self->class_id);
-    sprintf(model_filename, "%s.mdx", UNIT_MODEL(self->class_id));
+    snprintf(model_filename, sizeof(model_filename), "%s.mdx", UNIT_MODEL(self->class_id));
     self->s.model = G_RegisterModel(model_filename);
     self->s.splat = M_LoadUberSplat(uber_splat);
     if (UNIT_IS_BUILDING(self->class_id)) {

games/warcraft-3/game/skills/s_build.c

@@ -36,7 +36,7 @@ static void FillUnitData(LPENTITYSTATE ent, DWORD unit_id, LPCSTR anim) {
     LPCSTR model_filename = UNIT_MODEL(unit_id);
     if (!model_filename)
         return;
-    sprintf(buffer, "%s.mdx", model_filename);
+    snprintf(buffer, sizeof(buffer), "%s.mdx", model_filename);
     memset(ent, 0, sizeof(entityState_t));
     ent->class_id = unit_id;
     ent->model = G_RegisterModel(buffer);

games/warcraft-3/jass/jlex.c

@@ -62,16 +62,27 @@ LPCSTR parse_segment(LPPARSER p) {
     if (*p->buffer == '\"') {
         ++start;
         p->buffer = strchr(start, '\"');
-        memcpy(segment, start, p->buffer - start);
-        segment[p->buffer - start] = '\0';
+        if (!p->buffer) {
+            p->buffer = start + strlen(start);
+        }
+        size_t seglen = (size_t)(p->buffer - start);
+        if (seglen >= MAX_SEGMENT_SIZE) {
+            seglen = MAX_SEGMENT_SIZE - 1;
+        }
+        memcpy(segment, start, seglen);
+        segment[seglen] = '\0';
         p->buffer = strchr(p->buffer, ',');
     } else {
         p->buffer = strchr(p->buffer, ',');
         if (p->buffer) {
-            memcpy(segment, start, p->buffer - start);
-            segment[p->buffer - start] = '\0'; // Null-terminate the segment
+            size_t seglen = (size_t)(p->buffer - start);
+            if (seglen >= MAX_SEGMENT_SIZE) {
+                seglen = MAX_SEGMENT_SIZE - 1;
+            }
+            memcpy(segment, start, seglen);
+            segment[seglen] = '\0'; // Null-terminate the segment
         } else {
-            strcpy(segment, start);
+            strlcpy(segment, start, MAX_SEGMENT_SIZE);
             p->buffer = start + strlen(start);
             return segment;
         }
@@ -88,15 +99,20 @@ LPCSTR parse_segment2(LPPARSER p) {
     while (isspace(*p->buffer))
         ++p->buffer;
     DWORD num_quotes = 0;
-    for (LPSTR out = segment; *p->buffer; ++p->buffer, ++out) {
+    LPSTR out = segment;
+    LPSTR const out_end = segment + MAX_SEGMENT_SIZE - 1;
+    for (; *p->buffer; ++p->buffer) {
         if (*p->buffer == ',' && (num_quotes & 1) == 0) {
             ++p->buffer;
             break;
         }
         if (*p->buffer == '"')
             ++num_quotes;
-        *out = *p->buffer;
+        if (out < out_end) {
+            *out++ = *p->buffer;
+        }
     }
+    *out = '\0';
     return segment;
 }
 

games/warcraft-3/jass/jparser.c

@@ -173,7 +173,7 @@ LPTOKEN alloc_ident_token(LPPARSER p, TOKENTYPE tt) {
 
 LPTOKEN parse_operator_token(LPPARSER p) {
     UINAME op = { 0 };
-    strcpy(op, parse_token(p));
+    strlcpy(op, parse_token(p), sizeof(op));
     if (eat_token(p, "=")) {
         op[1] = '=';
     }

games/warcraft-3/renderer/r_game.c

@@ -59,8 +59,8 @@ void R_GameLoadAssets(void) {
     }
     FOR_LOOP(team, MAX_TEAMS) {
         PATHSTR glowFilename, colorFilename;
-        sprintf(glowFilename, "ReplaceableTextures\\TeamGlow\\TeamGlow%02d.blp", team);
-        sprintf(colorFilename, "ReplaceableTextures\\TeamColor\\TeamColor%02d.blp", team);
+        snprintf(glowFilename, sizeof(glowFilename), "ReplaceableTextures\\TeamGlow\\TeamGlow%02d.blp", team);
+        snprintf(colorFilename, sizeof(colorFilename), "ReplaceableTextures\\TeamColor\\TeamColor%02d.blp", team);
         tr.texture[TEX_TEAM_GLOW + team] = R_LoadTexture(glowFilename);
         tr.texture[TEX_TEAM_COLOR + team] = R_LoadTexture(colorFilename);
     }
@@ -125,8 +125,11 @@ LPMODEL R_GameLoadModel(LPCSTR modelFilename) {
         PATHSTR tempFileName = { 0 };
         size_t stemLen = strlen(modelFilename) - 4; /* ".mdl" = 4 chars */
 
-        strncpy(tempFileName, modelFilename, stemLen);
-        strcpy(tempFileName + stemLen, ".mdx");
+        if (stemLen > sizeof(tempFileName) - 5) {
+            stemLen = sizeof(tempFileName) - 5;
+        }
+        memcpy(tempFileName, modelFilename, stemLen);
+        memcpy(tempFileName + stemLen, ".mdx", 5);
         fileSize = ri.FS_ReadFile(tempFileName, &buffer);
     }
     if (fileSize < 0) {
@@ -140,8 +143,11 @@ LPMODEL R_GameLoadModel(LPCSTR modelFilename) {
                 end--;
             }
             stemLen = (size_t)(end - modelFilename);
-            strncpy(tempFileName, modelFilename, stemLen);
-            strcpy(tempFileName + stemLen, ".mdx");
+            if (stemLen > sizeof(tempFileName) - 5) {
+                stemLen = sizeof(tempFileName) - 5;
+            }
+            memcpy(tempFileName, modelFilename, stemLen);
+            memcpy(tempFileName + stemLen, ".mdx", 5);
             fileSize = ri.FS_ReadFile(tempFileName, &buffer);
         }
     }
@@ -157,8 +163,11 @@ LPMODEL R_GameLoadModel(LPCSTR modelFilename) {
         PATHSTR tempFileName = { 0 };
         size_t stemLen = strlen(modelFilename) - 4;
 
-        strncpy(tempFileName, modelFilename, stemLen);
-        strcpy(tempFileName + stemLen, ".mdx");
+        if (stemLen > sizeof(tempFileName) - 5) {
+            stemLen = sizeof(tempFileName) - 5;
+        }
+        memcpy(tempFileName, modelFilename, stemLen);
+        memcpy(tempFileName + stemLen, ".mdx", 5);
         ri.FS_FreeFile(buffer);
         return R_LoadModel(tempFileName);
     } else {