(svn r767) Introduce USERSTRING_LEN (128) and try to make sure we don't overflow it anywhere (as long as we keep USERSTRING_LEN above 7 or so).

4 files changed, 7 insertions, 3 deletions

diff --git a/engine.c b/engine.c
index 23916de88..f980703bc 100644
--- a/engine.c
+++ b/engine.c
@@ -601,7 +601,8 @@ StringID GetCustomEngineName(int engine)
 {
 	if (!_engine_custom_names[engine])
 		return _engine_name_strings[engine];
-	strcpy(_userstring, _engine_custom_names[engine]);
+	strncpy(_userstring, _engine_custom_names[engine], USERSTRING_LEN);
+	_userstring[USERSTRING_LEN - 1] = '\0';
 	return STR_SPEC_USERSTRING;
 }
 
diff --git a/misc_gui.c b/misc_gui.c
index 7ca26c09e..8e1957c46 100644
--- a/misc_gui.c
+++ b/misc_gui.c
@@ -53,7 +53,7 @@ static void LandInfoWndProc(Window *w, WindowEvent *e)
 		}
 		DrawStringCentered(140, 38, str, 0);
 
-		sprintf(_userstring, "%.4X", lid->tile);
+		snprintf(_userstring, USERSTRING_LEN, "%.4X", lid->tile);
 		SET_DPARAM16(0, GET_TILE_X(lid->tile));
 		SET_DPARAM16(1, GET_TILE_Y(lid->tile));
 		SET_DPARAM16(2, STR_SPEC_USERSTRING);
diff --git a/station_gui.c b/station_gui.c
index c0fca5411..9cbf0a66d 100644
--- a/station_gui.c
+++ b/station_gui.c
@@ -375,6 +375,8 @@ static void DrawStationViewWindow(Window *w)
 		b += 3;
 
 		for(i=0; i!=NUM_CARGO; i++) {
+			if (b + 5 > USERSTRING_LEN - 1)
+				break;
 			if (st->goods[i].waiting_acceptance & 0x8000) {
 				b[0] = 0x81;
 				WRITE_LE_UINT16(b+1, _cargoc.names_s[i]);
diff --git a/variables.h b/variables.h
index c181af4bb..d96a8bd24 100644
--- a/variables.h
+++ b/variables.h
@@ -431,7 +431,8 @@ extern const TileIndexDiff _tileoffs_by_dir[4];
 /* misc */
 VARDEF byte str_buffr[512];
 VARDEF char _screenshot_name[128];
-VARDEF char _userstring[128];
+#define USERSTRING_LEN 128
+VARDEF char _userstring[USERSTRING_LEN];
 VARDEF byte _vehicle_design_names;
 
 VARDEF SignStruct _sign_list[40];