From 3b7da58dec62d77429b4bad8e78bc52c41d63814 Mon Sep 17 00:00:00 2001 From: John P Date: Fri, 17 Jul 2026 14:12:55 -0400 Subject: [PATCH] fix: ServiceTag %ls buffer overread in Profile UI ServiceTag is a fixed wchar_t[4] with no null terminator. sprintf's %ls walks until it finds a null word, so a profile whose tag uses all 4 characters (common for real player profiles) reads past the array and can overflow the 1024-byte stack buffer - this runs every frame the Profile section is rendered. Also clears the field before writing edits back so shortening a tag can't leave stale trailing characters. Co-Authored-By: Claude --- src/mcc/CUserProfile.cpp | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/src/mcc/CUserProfile.cpp b/src/mcc/CUserProfile.cpp index cb4ca37..2562f2d 100644 --- a/src/mcc/CUserProfile.cpp +++ b/src/mcc/CUserProfile.cpp @@ -4,13 +4,24 @@ #include "imgui.h" #include +#include +#include void CUserProfile::ImGuiContext() { bool result = false; char buffer[1024]; - sprintf(buffer, "%ls", ServiceTag); + // ServiceTag is a fixed wchar_t[4] with NO null terminator - a real + // 4-character tag fills every slot, so printing it with %ls reads past + // the array and can smash the stack buffer. Convert through a + // null-terminated copy instead. + wchar_t tagCopy[5] = {}; + memcpy(tagCopy, ServiceTag, sizeof(ServiceTag)); + snprintf(buffer, sizeof(buffer), "%ls", tagCopy); if (ImGui::InputText("ServiceTag", buffer, 5, ImGuiInputTextFlags_CallbackCompletion)) { + // Clear first: shortening a tag must not leave stale trailing + // characters (which would recreate an unterminated 4-char tag). + wmemset(ServiceTag, 0, 4); for (int i = 0; i < 4; ++i) { if (buffer[i] == 0) break; ServiceTag[i] = buffer[i];