public: remove Q_strcat and Q_strcpy, and patch the code that uses it

engine/client/cl_debug.c

@@ -45,7 +45,7 @@ const char *CL_MsgInfo( int cmd )
 {
 	static string	sz;
 
-	Q_strcpy( sz, "???" );
+	Q_strncpy( sz, "???", sizeof( sz ));
 
 	if( cmd >= 0 && cmd <= svc_lastmsg )
 	{

engine/client/cl_game.c

@@ -2569,7 +2569,7 @@ const char *pfnGetGameDirectory( void )
 {
 	static char	szGetGameDir[MAX_SYSPATH];
 
-	Q_strcpy( szGetGameDir, GI->gamefolder );
+	Q_strncpy( szGetGameDir, GI->gamefolder, sizeof( szGetGameDir ));
 	return szGetGameDir;
 }
 

engine/client/cl_main.c

@@ -1294,15 +1294,15 @@ void CL_Rcon_f( void )
 
 	NET_Config( true, false );	// allow remote
 
-	Q_strcat( message, "rcon " );
-	Q_strcat( message, rcon_password.string );
-	Q_strcat( message, " " );
+	Q_strncat( message, "rcon ", sizeof( message ));
+	Q_strncat( message, rcon_password.string, sizeof( message ));
+	Q_strncat( message, " ", sizeof( message ) );
 
 	for( i = 1; i < Cmd_Argc(); i++ )
 	{
 		Cmd_Escape( command, Cmd_Argv( i ), sizeof( command ));
-		Q_strcat( message, command );
-		Q_strcat( message, " " );
+		Q_strncat( message, command, sizeof( message ));
+		Q_strncat( message, " ", sizeof( message ));
 	}
 
 	if( cls.state >= ca_connected )

engine/client/in_touch.c

@@ -1498,9 +1498,9 @@ static void Touch_EditMove( touchEventType type, int fingerID, float x, float y,
 				touch.hidebutton->flags &= ~TOUCH_FL_HIDE;
 
 				if( FBitSet( button->flags, TOUCH_FL_HIDE ))
-					Q_strcpy( touch.hidebutton->texturefile, "touch_default/edit_show" );
+					Q_strncpy( touch.hidebutton->texturefile, "touch_default/edit_show", sizeof( touch.hidebutton->texturefile ));
 				else
-					Q_strcpy( touch.hidebutton->texturefile, "touch_default/edit_hide" );
+					Q_strncpy( touch.hidebutton->texturefile, "touch_default/edit_hide", sizeof( touch.hidebutton->texturefile ));
 			}
 		}
 		if( type == event_motion ) // shutdown button move

engine/client/ref_common.c

@@ -512,7 +512,7 @@ static void R_GetRendererName( char *dest, size_t size, const char *opt )
 	else
 	{
 		// full path
-		Q_strcpy( dest, opt );
+		Q_strncpy( dest, opt, size );
 	}
 }
 

engine/client/s_vox.c

@@ -142,7 +142,7 @@ static const char *VOX_GetDirectory( char *szpath, const char *psz, int nsize )
 
 	if( !p )
 	{
-		Q_strcpy( szpath, "vox/" );
+		Q_strncpy( szpath, "vox/", nsize );
 		return psz;
 	}
 

engine/client/titles.c

@@ -218,6 +218,7 @@ void CL_TextMessageParse( byte *pMemFile, int fileSize )
 	client_textmessage_t	textMessages[MAX_MESSAGES];
 	int			i, nameHeapSize, textHeapSize, messageSize, nameOffset;
 	int			messageCount, lastNamePos;
+	size_t		textHeapSizeRemaining;
 
 	lastNamePos = 0;
 	lineNumber = 0;
@@ -252,7 +253,7 @@ void CL_TextMessageParse( byte *pMemFile, int fileSize )
 				Con_Reportf( "TextMessage: unexpected '}' found, line %d\n", lineNumber );
 				return;
 			}
-			Q_strcpy( currentName, trim );
+			Q_strncpy( currentName, trim, sizeof( currentName ));
 			break;
 		case MSGFILE_TEXT:
 			if( IsEndOfText( trim ))
@@ -266,7 +267,7 @@ void CL_TextMessageParse( byte *pMemFile, int fileSize )
 					return;
 				}
 
-				Q_strcpy( nameHeap + lastNamePos, currentName );
+				Q_strncpy( nameHeap + lastNamePos, currentName, sizeof( nameHeap ) - lastNamePos );
 
 				// terminate text in-place in the memory file
 				// (it's temporary memory that will be deleted)
@@ -329,15 +330,20 @@ void CL_TextMessageParse( byte *pMemFile, int fileSize )
 
 
 	// copy text & fixup pointers
+	textHeapSizeRemaining = textHeapSize;
 	pCurrentText = pNameHeap + nameHeapSize;
 
 	for( i = 0; i < messageCount; i++ )
 	{
+		size_t currentTextSize = Q_strlen( clgame.titles[i].pMessage ) + 1;
+
 		clgame.titles[i].pName = pNameHeap;			// adjust name pointer (parallel buffer)
-		Q_strcpy( pCurrentText, clgame.titles[i].pMessage );	// copy text over
+		Q_strncpy( pCurrentText, clgame.titles[i].pMessage, textHeapSizeRemaining );	// copy text over
 		clgame.titles[i].pMessage = pCurrentText;
+
 		pNameHeap += Q_strlen( pNameHeap ) + 1;
-		pCurrentText += Q_strlen( pCurrentText ) + 1;
+		pCurrentText += currentTextSize;
+		textHeapSizeRemaining -= currentTextSize;
 	}
 
 	if(( pCurrentText - (char *)clgame.titles ) != ( textHeapSize + nameHeapSize + messageSize ))