mirror of
https://github.com/Cesarus85/ringfall-mjolnir-vr.git
synced 2026-10-23 05:00:32 +02:00
The scenario's tag name was copied with strcpy into the game state header's 256-byte map_name, a tag's name was formatted with sprintf into the out of objects message's 512 bytes, and csprintf bounded its output at MAXIMUM_STRING_SIZE even when it formats into temporary, which is 256 bytes and where most callers put tag names. All three are bounded by their buffers' sizes now.