fix: replace sprintf with snprintf to prevent buffer overflows in q3map2

q3map2/q3map2/bsp.c

@@ -420,7 +420,7 @@ void ProcessWorldModel( void ){
 	/* ydnar: fog hull */
 	value = ValueForKey( &entities[ 0 ], "_foghull" );
 	if ( value[ 0 ] != '\0' ) {
-		sprintf( shader, "textures/%s", value );
+		snprintf( shader, sizeof(shader), "textures/%s", value );
 		MakeFogHullSurfs( e, tree, shader );
 	}
 
@@ -630,7 +630,7 @@ void OnlyEnts( void ){
 	/* note it */
 	Sys_Printf( "--- OnlyEnts ---\n" );
 
-	sprintf( out, "%s.bsp", source );
+	snprintf( out, sizeof(out), "%s.bsp", source );
 	LoadBSPFile( out );
 	numEntities = 0;
 
@@ -864,9 +864,9 @@ int BSPMain( int argc, char **argv ){
 	SetDefaultSampleSize( sampleSize );
 
 	/* delete portal, line and surface files */
-	sprintf( path, "%s.prt", source );
+	snprintf( path, sizeof(path), "%s.prt", source );
 	remove( path );
-	sprintf( path, "%s.lin", source );
+	snprintf( path, sizeof(path), "%s.lin", source );
 	remove( path );
 	//%	sprintf( path, "%s.srf", source );	/* ydnar */
 	//%	remove( path );
@@ -875,7 +875,7 @@ int BSPMain( int argc, char **argv ){
 	strcpy( name, ExpandArg( argv[ i ] ) );
 	if ( strcmp( name + strlen( name ) - 4, ".reg" ) ) {
 		/* if we are doing a full map, delete the last saved region map */
-		sprintf( path, "%s.reg", source );
+		snprintf( path, sizeof(path), "%s.reg", source );
 		remove( path );
 		DefaultExtension( name, ".map" );   /* might be .reg */
 	}

q3map2/q3map2/bspfile_abstract.c

@@ -397,7 +397,7 @@ void WriteBSPFile( const char *filename ){
 
 	/* make fake temp name so existing bsp file isn't damaged in case write process fails */
 	time( &tm );
-	sprintf( tempname, "%s.%08X", filename, (int) tm );
+	snprintf( tempname, sizeof(tempname), "%s.%08X", filename, (int) tm );
 
 	/* byteswap, write the bsp, then swap back so it can be manipulated further */
 	SwapBSPFile();

q3map2/q3map2/convert_ase.c

@@ -56,7 +56,7 @@ static void ConvertSurface( FILE *f, bspModel_t *model, int modelNum, bspDrawSur
 	}
 
 	/* print object header for each dsurf */
-	sprintf( name, "mat%dmodel%dsurf%d", ds->shaderNum, modelNum, surfaceNum );
+	snprintf( name, sizeof(name), "mat%dmodel%dsurf%d", ds->shaderNum, modelNum, surfaceNum );
 	fprintf( f, "*GEOMOBJECT\t{\r\n" );
 	fprintf( f, "\t*NODE_NAME\t\"%s\"\r\n", name );
 	fprintf( f, "\t*NODE_TM\t{\r\n" );

q3map2/q3map2/path_init.c

@@ -271,7 +271,7 @@ void AddHomeBasePath( char *path ){
 		basePaths[ i + 1 ] = basePaths[ i ];
 
 	/* concatenate home dir and path */
-	sprintf( temp, "%s/%s", homePath, path );
+	snprintf( temp, sizeof(temp), "%s/%s", homePath, path );
 
 	/* add it to the list */
 	basePaths[ 0 ] = safe_malloc( strlen( temp ) + 1 );
@@ -450,7 +450,7 @@ void InitPaths( int *argc, char **argv ){
 		for ( i = 0; i < numBasePaths; i++ )
 		{
 			/* create a full path and initialize it */
-			sprintf( temp, "%s/%s/", basePaths[ i ], gamePaths[ j ] );
+			snprintf( temp, sizeof(temp), "%s/%s/", basePaths[ i ], gamePaths[ j ] );
 			//quick n dirty patch to enable vfs for quakelive
 			if (strcmp(game->arg, "quakelive") == 0 ) {
 				unz_GAME_QL = 1;

q3map2/q3map2/vis.c

@@ -1123,14 +1123,14 @@ int VisMain( int argc, char **argv ){
 
 
 	/* load the bsp */
-	sprintf( source, "%s%s", inbase, ExpandArg( argv[ i ] ) );
+	snprintf( source, sizeof(source), "%s%s", inbase, ExpandArg( argv[ i ] ) );
 	StripExtension( source );
 	strcat( source, ".bsp" );
 	Sys_Printf( "Loading %s\n", source );
 	LoadBSPFile( source );
 
 	/* load the portal file */
-	sprintf( portalfile, "%s%s", inbase, ExpandArg( argv[ i ] ) );
+	snprintf( portalfile, sizeof(portalfile), "%s%s", inbase, ExpandArg( argv[ i ] ) );
 	StripExtension( portalfile );
 	strcat( portalfile, ".prt" );
 	Sys_Printf( "Loading %s\n", portalfile );