::stable-branch::reset=bb9d5e97ff495d6908929a7bdf832e609c825b2f

diff --git a/cmd.c b/cmd.c
index 13d86e00cca360ad64718aa107aed480ac43b553..cab160b4220a10811d322d70d960b1d3474c95cf 100644 (file)
--- a/cmd.c
+++ b/cmd.c
@@ -976,7 +976,7 @@ static const char *Cmd_GetDirectCvarValue(const char *varname, cmdalias_t *alias
        cvar_t *cvar;
        long argno;
        char *endptr;
-       char vabuf[1024];
+       static char vabuf[1024]; // cmd_mutex
 
        if(is_multiple)
                *is_multiple = false;

diff --git a/collision.h b/collision.h
index f4f476177f03bed1e619f4c8c0752a1d468ecc8c..70fbd48551bd90cd69a3e54bd1c0fb7dd1d0d677 100644 (file)
--- a/collision.h
+++ b/collision.h
@@ -2,10 +2,14 @@
 #ifndef COLLISION_H
 #define COLLISION_H
 
-typedef struct plane_s
+typedef union plane_s
 {
-       vec3_t  normal;
-       float   dist;
+       struct
+       {
+               vec3_t  normal;
+               vec_t   dist;
+       };
+       vec4_t dist_and_normal;
 }
 plane_t;
 
@@ -76,8 +80,15 @@ typedef struct colplanef_s
 {
        const struct texture_s *texture;
        int q3surfaceflags;
-       vec3_t normal;
-       vec_t dist;
+       union
+       {
+               struct
+               {
+                       vec3_t normal;
+                       vec_t dist;
+               };
+               vec4_t normal_and_dist;
+       };
 }
 colplanef_t;
 

diff --git a/common.c b/common.c
index 667f99c6bbe887ca940a568f632663c81dcbf198..66b7895a2118c2550dabc8f3bef9e77cfb8b1a99 100644 (file)
--- a/common.c
+++ b/common.c
@@ -1619,13 +1619,22 @@ void COM_Init_Commands (void)
                if (strstr(com_argv[j], " "))
                {
                        // arg contains whitespace, store quotes around it
+                       // This condition checks whether we can allow to put
+                       // in two quote characters.
+                       if (n >= ((int)sizeof(com_cmdline) - 2))
+                               break;
                        com_cmdline[n++] = '\"';
+                       // This condition checks whether we can allow one
+                       // more character and a quote character.
                        while ((n < ((int)sizeof(com_cmdline) - 2)) && com_argv[j][i])
+                               // FIXME: Doesn't quote special characters.
                                com_cmdline[n++] = com_argv[j][i++];
                        com_cmdline[n++] = '\"';
                }
                else
                {
+                       // This condition checks whether we can allow one
+                       // more character.
                        while ((n < ((int)sizeof(com_cmdline) - 1)) && com_argv[j][i])
                                com_cmdline[n++] = com_argv[j][i++];
                }
@@ -2084,7 +2093,7 @@ void InfoString_SetValue(char *buffer, size_t bufferlength, const char *key, con
                Con_Printf("InfoString_SetValue: no room for \"%s\" \"%s\" in infostring\n", key, value);
                return;
        }
-       if (value && value[0])
+       if (value[0])
        {
                // set the key/value and append the remaining text
                char tempbuffer[MAX_INPUTLINE];

diff --git a/crypto.c b/crypto.c
index 016ff9b6072aa7505cb0f58ba77f5fb574f64a88..8428c6784c483e44e6070b286e334734e9490ec2 100644 (file)
--- a/crypto.c
+++ b/crypto.c
@@ -412,17 +412,12 @@ static const char *GetUntilNul(const char **data, size_t *len)
                *len = 0;
                return NULL;
        }
-       else
-       {
-               n = (p - *data) + 1;
-               *len -= n;
-               *data += n;
-               if(*len == 0)
-                       *data = NULL;
-               return (const char *) data_save;
-       }
-       *data = NULL;
-       return NULL;
+       n = (p - *data) + 1;
+       *len -= n;
+       *data += n;
+       if(*len == 0)
+               *data = NULL;
+       return (const char *) data_save;
 }
 
 // d0pk reading
@@ -1073,17 +1068,17 @@ static void Crypto_KeyGen_Finished(int code, size_t length_received, unsigned ch
                return;
        }
 
-       if(keygen_i >= MAX_PUBKEYS || !pubkeys[keygen_i])
+       if(keygen_i < 0)
        {
-               Con_Printf("overflow of keygen_i\n");
-               keygen_i = -1;
+               Con_Printf("Unexpected response from keygen server:\n");
+               Com_HexDumpToConsole(buffer, (int)length_received);
                SV_UnlockThreadMutex();
                return;
        }
-       if(keygen_i < 0)
+       if(keygen_i >= MAX_PUBKEYS || !pubkeys[keygen_i])
        {
-               Con_Printf("Unexpected response from keygen server:\n");
-               Com_HexDumpToConsole(buffer, (int)length_received);
+               Con_Printf("overflow of keygen_i\n");
+               keygen_i = -1;
                SV_UnlockThreadMutex();
                return;
        }
@@ -2320,7 +2315,7 @@ int Crypto_ClientParsePacket(const char *data_in, size_t len_in, char *data_out,
                                CDATA->next_step = 1;
                                *len_out = data_out_p - data_out;
                        }
-                       else if(clientid >= 0)
+                       else // if(clientid >= 0) // guaranteed by condition one level outside
                        {
                                // skip over server auth, perform client auth only
                                if(!CDATA->id)
@@ -2344,8 +2339,6 @@ int Crypto_ClientParsePacket(const char *data_in, size_t len_in, char *data_out,
                                data_out_p += *len_out;
                                *len_out = data_out_p - data_out;
                        }
-                       else
-                               *len_out = data_out_p - data_out;
 
                        return CRYPTO_DISCARD;
                }

diff --git a/fs.c b/fs.c
index 994155aa290fe5ad69bb3b05e7531ae28995b64d..5b9c14974869ab3565f1c23f0560994b30caa7c4 100644 (file)
--- a/fs.c
+++ b/fs.c
@@ -586,6 +586,16 @@ static qboolean PK3_GetEndOfCentralDir (const char *packfile, int packhandle, pk
 
        Mem_Free (buffer);
 
+       if (
+                       eocd->cdir_size < 0 || eocd->cdir_size > filesize ||
+                       eocd->cdir_offset < 0 || eocd->cdir_offset >= filesize ||
+                       eocd->cdir_offset + eocd->cdir_size > filesize
+          )
+       {
+               // Obviously invalid central directory.
+               return false;
+       }
+
        return true;
 }
 
@@ -605,7 +615,11 @@ static int PK3_BuildFileList (pack_t *pack, const pk3_endOfCentralDir_t *eocd)
 
        // Load the central directory in memory
        central_dir = (unsigned char *)Mem_Alloc (tempmempool, eocd->cdir_size);
-       lseek (pack->handle, eocd->cdir_offset, SEEK_SET);
+       if (lseek (pack->handle, eocd->cdir_offset, SEEK_SET) == -1)
+       {
+               Mem_Free (central_dir);
+               return -1;
+       }
        if(read (pack->handle, central_dir, eocd->cdir_size) != (fs_offset_t) eocd->cdir_size)
        {
                Mem_Free (central_dir);
@@ -654,7 +668,7 @@ static int PK3_BuildFileList (pack_t *pack, const pk3_endOfCentralDir_t *eocd)
                if ((ptr[8] & 0x21) == 0 && (ptr[38] & 0x18) == 0)
                {
                        // Still enough bytes for the name?
-                       if (remaining < namesize || namesize >= (int)sizeof (*pack->files))
+                       if (namesize < 0 || remaining < namesize || namesize >= (int)sizeof (*pack->files))
                        {
                                Mem_Free (central_dir);
                                return -1;
@@ -797,7 +811,11 @@ static qboolean PK3_GetTrueFileOffset (packfile_t *pfile, pack_t *pack)
                return true;
 
        // Load the local file description
-       lseek (pack->handle, pfile->offset, SEEK_SET);
+       if (lseek (pack->handle, pfile->offset, SEEK_SET) == -1)
+       {
+               Con_Printf ("Can't seek in package %s\n", pack->filename);
+               return false;
+       }
        count = read (pack->handle, buffer, ZIP_LOCAL_CHUNK_BASE_SIZE);
        if (count != ZIP_LOCAL_CHUNK_BASE_SIZE || BuffBigLong (buffer) != ZIP_DATA_HEADER)
        {
@@ -875,6 +893,25 @@ static packfile_t* FS_AddFileToPack (const char* name, pack_t* pack,
 }
 
 
+static void FS_mkdir (const char *path)
+{
+       if(COM_CheckParm("-readonly"))
+               return;
+
+#if WIN32
+       if (_mkdir (path) == -1)
+#else
+       if (mkdir (path, 0777) == -1)
+#endif
+       {
+               // No logging for this. The only caller is FS_CreatePath (which
+               // calls it in ways that will intentionally produce EEXIST),
+               // and its own callers always use the directory afterwards and
+               // thus will detect failure that way.
+       }
+}
+
+
 /*
 ============
 FS_CreatePath
@@ -970,7 +1007,7 @@ static pack_t *FS_LoadPackPAK (const char *packfile)
 
        numpackfiles = header.dirlen / sizeof(dpackfile_t);
 
-       if (numpackfiles > MAX_FILES_IN_PACK)
+       if (numpackfiles < 0 || numpackfiles > MAX_FILES_IN_PACK)
        {
                Con_Printf ("%s has %i files\n", packfile, numpackfiles);
                close(packhandle);
@@ -1000,6 +1037,9 @@ static pack_t *FS_LoadPackPAK (const char *packfile)
                fs_offset_t offset = (unsigned int)LittleLong (info[i].filepos);
                fs_offset_t size = (unsigned int)LittleLong (info[i].filelen);
 
+               // Ensure a zero terminated file name (required by format).
+               info[i].name[sizeof(info[i].name) - 1] = 0;
+
                FS_AddFileToPack (info[i].name, pack, offset, size, size, PACKFILE_FLAG_TRUEOFFS);
        }
 
@@ -1894,7 +1934,7 @@ static int FS_ChooseUserDir(userdirmode_t userdirmode, char *userdir, size_t use
        if(access(va(vabuf, sizeof(vabuf), "%s%s/", userdir, gamedirname1), W_OK | X_OK) >= 0)
                fd = 1;
        else
-               fd = 0;
+               fd = -1;
 #endif
        if(fd >= 0)
        {
@@ -2675,7 +2715,15 @@ int FS_Close (qfile_t* file)
        if (file->filename)
        {
                if (file->flags & QFILE_FLAG_REMOVE)
-                       remove(file->filename);
+               {
+                       if (remove(file->filename) == -1)
+                       {
+                               // No need to report this. If removing a just
+                               // written file failed, this most likely means
+                               // someone else deleted it first - which we
+                               // like.
+                       }
+               }
 
                Mem_Free((void *) file->filename);
        }
@@ -2708,7 +2756,12 @@ fs_offset_t FS_Write (qfile_t* file, const void* data, size_t datasize)
 
        // If necessary, seek to the exact file position we're supposed to be
        if (file->buff_ind != file->buff_len)
-               lseek (file->handle, file->buff_ind - file->buff_len, SEEK_CUR);
+       {
+               if (lseek (file->handle, file->buff_ind - file->buff_len, SEEK_CUR) == -1)
+               {
+                       Con_Printf("WARNING: could not seek in %s.\n", file->filename);
+               }
+       }
 
        // Purge cached data
        FS_Purge (file);
@@ -2801,7 +2854,12 @@ fs_offset_t FS_Read (qfile_t* file, void* buffer, size_t buffersize)
                {
                        if (count > (fs_offset_t)buffersize)
                                count = (fs_offset_t)buffersize;
-                       lseek (file->handle, file->offset + file->position, SEEK_SET);
+                       if (lseek (file->handle, file->offset + file->position, SEEK_SET) == -1)
+                       {
+                               // Seek failed. When reading from a pipe, and
+                               // the caller never called FS_Seek, this still
+                               // works fine.  So no reporting this error.
+                       }
                        nb = read (file->handle, &((unsigned char*)buffer)[done], count);
                        if (nb > 0)
                        {
@@ -2816,7 +2874,12 @@ fs_offset_t FS_Read (qfile_t* file, void* buffer, size_t buffersize)
                {
                        if (count > (fs_offset_t)sizeof (file->buff))
                                count = (fs_offset_t)sizeof (file->buff);
-                       lseek (file->handle, file->offset + file->position, SEEK_SET);
+                       if (lseek (file->handle, file->offset + file->position, SEEK_SET) == -1)
+                       {
+                               // Seek failed. When reading from a pipe, and
+                               // the caller never called FS_Seek, this still
+                               // works fine.  So no reporting this error.
+                       }
                        nb = read (file->handle, file->buff, count);
                        if (nb > 0)
                        {
@@ -3089,7 +3152,8 @@ int FS_Seek (qfile_t* file, fs_offset_t offset, int whence)
                ztk->in_len = 0;
                ztk->in_position = 0;
                file->position = 0;
-               lseek (file->handle, file->offset, SEEK_SET);
+               if (lseek (file->handle, file->offset, SEEK_SET) == -1)
+                       Con_Printf("IMPOSSIBLE: couldn't seek in already opened pk3 file.\n");
 
                // Reset the Zlib stream
                ztk->zstream.next_in = ztk->input;
@@ -3381,18 +3445,6 @@ qboolean FS_SysFileExists (const char *path)
        return FS_SysFileType (path) != FS_FILETYPE_NONE;
 }
 
-void FS_mkdir (const char *path)
-{
-       if(COM_CheckParm("-readonly"))
-               return;
-
-#if WIN32
-       _mkdir (path);
-#else
-       mkdir (path, 0777);
-#endif
-}
-
 /*
 ===========
 FS_Search
@@ -3772,7 +3824,7 @@ qboolean FS_IsRegisteredQuakePack(const char *name)
                                int diff;
 
                                middle = (left + right) / 2;
-                               diff = !strcmp_funct (pak->files[middle].name, "gfx/pop.lmp");
+                               diff = strcmp_funct (pak->files[middle].name, "gfx/pop.lmp");
 
                                // Found it
                                if (!diff)
@@ -3883,8 +3935,7 @@ unsigned char *FS_Deflate(const unsigned char *data, size_t size, size_t *deflat
                return NULL;
        }
 
-       if(deflated_size)
-               *deflated_size = (size_t)strm.total_out;
+       *deflated_size = (size_t)strm.total_out;
 
        memcpy(out, tmp, strm.total_out);
        Mem_Free(tmp);
@@ -3998,8 +4049,7 @@ unsigned char *FS_Inflate(const unsigned char *data, size_t size, size_t *inflat
        memcpy(out, outbuf.data, outbuf.cursize);
        Mem_Free(outbuf.data);
 
-       if(inflated_size)
-               *inflated_size = (size_t)outbuf.cursize;
+       *inflated_size = (size_t)outbuf.cursize;
        
        return out;
 }

diff --git a/fs.h b/fs.h
index cd1979a2939bb424550931e285cc1d1c8ed69200..657f6440a5a721a16bb03d868e4cdec1b1c911a2 100644 (file)
--- a/fs.h
+++ b/fs.h
@@ -129,8 +129,6 @@ int FS_SysFileType (const char *filename);          // only look for files outside of pa
 qboolean FS_FileExists (const char *filename);         // the file can be into a package
 qboolean FS_SysFileExists (const char *filename);      // only look for files outside of packages
 
-void FS_mkdir (const char *path);
-
 unsigned char *FS_Deflate(const unsigned char *data, size_t size, size_t *deflated_size, int level, mempool_t *mempool);
 unsigned char *FS_Inflate(const unsigned char *data, size_t size, size_t *inflated_size, mempool_t *mempool);
 

diff --git a/lhnet.c b/lhnet.c
index e3bc6b712186f54dd511fd4165ddfc2f54fa3c88..e2ded868e5508f268a6d8f49bc9b9267084f66f4 100644 (file)
--- a/lhnet.c
+++ b/lhnet.c
@@ -535,9 +535,9 @@ int LHNETADDRESS_ToString(const lhnetaddress_t *vaddress, char *string, int stri
 {
        lhnetaddressnative_t *address = (lhnetaddressnative_t *)vaddress;
        const unsigned char *a;
-       *string = 0;
        if (!address || !string || stringbuffersize < 1)
                return 0;
+       *string = 0;
        switch(address->addresstype)
        {
        default:
@@ -978,7 +978,13 @@ lhnetsocket_t *LHNET_OpenSocket_Connectionless(lhnetaddress_t *address)
                                                                namelen = sizeof(localaddress->addr.in6);
                                                                bindresult = bind(lhnetsocket->inetsocket, &localaddress->addr.sock, namelen);
                                                                if (bindresult != -1)
-                                                                       getsockname(lhnetsocket->inetsocket, &localaddress->addr.sock, &namelen);
+                                                               {
+                                                                       if (getsockname(lhnetsocket->inetsocket, &localaddress->addr.sock, &namelen))
+                                                                       {
+                                                                               // If getsockname failed, we can assume the bound socket is useless.
+                                                                               bindresult = -1;
+                                                                       }
+                                                               }
                                                        }
                                                        else
 #endif
@@ -986,7 +992,13 @@ lhnetsocket_t *LHNET_OpenSocket_Connectionless(lhnetaddress_t *address)
                                                                namelen = sizeof(localaddress->addr.in);
                                                                bindresult = bind(lhnetsocket->inetsocket, &localaddress->addr.sock, namelen);
                                                                if (bindresult != -1)
-                                                                       getsockname(lhnetsocket->inetsocket, &localaddress->addr.sock, &namelen);
+                                                               {
+                                                                       if (getsockname(lhnetsocket->inetsocket, &localaddress->addr.sock, &namelen))
+                                                                       {
+                                                                               // If getsockname failed, we can assume the bound socket is useless.
+                                                                               bindresult = -1;
+                                                                       }
+                                                               }
                                                        }
                                                        if (bindresult != -1)
                                                        {
@@ -997,7 +1009,10 @@ lhnetsocket_t *LHNET_OpenSocket_Connectionless(lhnetaddress_t *address)
                                                                {
                                                                        // enable DSCP for ToS support
                                                                        int tos = lhnet_default_dscp << 2;
-                                                                       setsockopt(lhnetsocket->inetsocket, IPPROTO_IP, IP_TOS, (char *) &tos, sizeof(tos));
+                                                                       if (setsockopt(lhnetsocket->inetsocket, IPPROTO_IP, IP_TOS, (char *) &tos, sizeof(tos)))
+                                                                       {
+                                                                               // Error in setsockopt - fine, we'll simply set no TOS then.
+                                                                       }
                                                                }
 #endif
                                                                lhnetsocket->next = &lhnet_socketlist;

diff --git a/netconn.c b/netconn.c
index 940bb1a71ac9768cd82298037b177ac29418bf20..b4ef314777fd24687b69aacffbb543a53da2dcd9 100755 (executable)
--- a/netconn.c
+++ b/netconn.c
@@ -2743,7 +2743,7 @@ static const char *RCon_Authenticate(lhnetaddress_t *peeraddress, const char *pa
        qboolean hasquotes;
        qboolean restricted = false;
        qboolean have_usernames = false;
-       char vabuf[1024];
+       static char vabuf[1024];
 
        userpass_start = rcon_password.string;
        while((userpass_end = strchr(userpass_start, ' ')))

diff --git a/protocol.c b/protocol.c
index 85db0877cb1311556d2dfcc924a0cf07d88bed6d..c0c8ac9d7e78ad07a44ab4e6862c6243cf7602f2 100644 (file)
--- a/protocol.c
+++ b/protocol.c
@@ -2540,8 +2540,8 @@ static void EntityState5_ReadUpdate(entity_state_t *s, int number)
                        if (!skeleton->relativetransforms || skeleton->model != model)
                        {
                                skeleton->model = model;
-                               skeleton->relativetransforms = (matrix4x4_t *) Mem_Realloc(cls.levelmempool, skeleton->relativetransforms, sizeof(*skeleton->relativetransforms) * skeleton->model->num_bones);
-                               for (bonenum = 0;bonenum < model->num_bones;bonenum++)
+                               skeleton->relativetransforms = (matrix4x4_t *) Mem_Realloc(cls.levelmempool, skeleton->relativetransforms, sizeof(*skeleton->relativetransforms) * numbones);
+                               for (bonenum = 0;bonenum < numbones;bonenum++)
                                        skeleton->relativetransforms[bonenum] = identitymatrix;
                        }
                        for (bonenum = 0;bonenum < numbones;bonenum++)

diff --git a/sv_main.c b/sv_main.c
index bfe2a794a81e34f28b36689542252cb9dd7f5a67..17a171dfd89b6572c0fd85e7e2e8de8f909148e6 100644 (file)
--- a/sv_main.c
+++ b/sv_main.c
@@ -933,7 +933,7 @@ void SV_SendServerinfo (client_t *client)
        MSG_WriteString (&client->netconnection->message,message);
 
        SV_StopDemoRecording(client); // to split up demos into different files
-       if(sv_autodemo_perclient.integer && client->netconnection)
+       if(sv_autodemo_perclient.integer)
        {
                char demofile[MAX_OSPATH];
                char ipaddress[MAX_QPATH];