From 648db4a2b3562f583c8240b331919a81ee02d653 Mon Sep 17 00:00:00 2001 From: Alibek Omarov Date: Sat, 30 May 2026 04:07:40 +0500 Subject: [PATCH] engine: common: xrcon: fix potential overflow and another recursion case --- engine/common/xrcon.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/engine/common/xrcon.c b/engine/common/xrcon.c index fa6a1da6..17a5ebc3 100644 --- a/engine/common/xrcon.c +++ b/engine/common/xrcon.c @@ -144,8 +144,9 @@ static qboolean XRcon_SendPacket( const char *type, const void *body, size_t bod int err = WSAGetLastError(); if( err != WSAEWOULDBLOCK && err != WSAEALREADY ) { - Con_Printf( S_ERROR "%s: send error %s\n", __func__, NET_ErrorString( )); + const char *errstr = NET_ErrorString(); XRcon_DisconnectClient(); + Con_Printf( S_ERROR "%s: send error %s\n", __func__, errstr ); return false; } sent = 0; @@ -157,8 +158,8 @@ static qboolean XRcon_SendPacket( const char *type, const void *body, size_t bod size_t available = sizeof( xrcon.tx_buffer ) - xrcon.tx_pos; if( available < unsent ) { - Con_Printf( S_ERROR "%s: transmit buffer overflow\n", __func__ ); XRcon_DisconnectClient(); + Con_Printf( S_ERROR "%s: transmit buffer overflow\n", __func__ ); return false; } @@ -335,7 +336,7 @@ static void XRcon_ProcessRxData( void ) { char cmd[XRCON_MAX_FRAME_SIZE]; size_t cmd_len = Q_min( payload_length, sizeof( cmd ) - 1 ); - memcpy( cmd, xrcon.rx_buffer, payload_length ); + memcpy( cmd, xrcon.rx_buffer, cmd_len ); cmd[cmd_len] = '\0'; XRcon_HandleCMND( cmd ); }