5 files changed, 24 insertions, 0 deletions

diff --git a/src/script/api/script_text.cpp b/src/script/api/script_text.cpp
index 577dd813e..f87b2e8b2 100644
--- a/src/script/api/script_text.cpp
+++ b/src/script/api/script_text.cpp
@@ -72,6 +72,7 @@ SQInteger ScriptText::_SetParam(int parameter, HSQUIRRELVM vm)
 			sq_getstring(vm, -1, &value);
 
 			this->params[parameter] = strdup(SQ2OTTD(value));
+			ValidateString(this->params[parameter]);
 			break;
 		}
 
@@ -147,6 +148,7 @@ SQInteger ScriptText::_set(HSQUIRRELVM vm)
 		const SQChar *key;
 		sq_getstring(vm, 2, &key);
 		const char *key_string = SQ2OTTD(key);
+		ValidateString(key_string);
 
 		if (strncmp(key_string, "param_", 6) != 0 || strlen(key_string) > 8) return SQ_ERROR;
 		k = atoi(key_string + 6);
diff --git a/src/script/script_info.cpp b/src/script/script_info.cpp
index a1db9e13e..8b84966f2 100644
--- a/src/script/script_info.cpp
+++ b/src/script/script_info.cpp
@@ -126,12 +126,15 @@ SQInteger ScriptInfo::AddSetting(HSQUIRRELVM vm)
 		const SQChar *sqkey;
 		if (SQ_FAILED(sq_getstring(vm, -2, &sqkey))) return SQ_ERROR;
 		const char *key = SQ2OTTD(sqkey);
+		ValidateString(key);
 
 		if (strcmp(key, "name") == 0) {
 			const SQChar *sqvalue;
 			if (SQ_FAILED(sq_getstring(vm, -1, &sqvalue))) return SQ_ERROR;
 			char *name = strdup(SQ2OTTD(sqvalue));
 			char *s;
+			ValidateString(name);
+
 			/* Don't allow '=' and ',' in configure setting names, as we need those
 			 *  2 chars to nicely store the settings as a string. */
 			while ((s = strchr(name, '=')) != NULL) *s = '_';
@@ -142,6 +145,7 @@ SQInteger ScriptInfo::AddSetting(HSQUIRRELVM vm)
 			const SQChar *sqdescription;
 			if (SQ_FAILED(sq_getstring(vm, -1, &sqdescription))) return SQ_ERROR;
 			config.description = strdup(SQ2OTTD(sqdescription));
+			ValidateString(config.description);
 			items |= 0x002;
 		} else if (strcmp(key, "min_value") == 0) {
 			SQInteger res;
@@ -227,6 +231,7 @@ SQInteger ScriptInfo::AddLabels(HSQUIRRELVM vm)
 	const SQChar *sq_setting_name;
 	if (SQ_FAILED(sq_getstring(vm, -2, &sq_setting_name))) return SQ_ERROR;
 	const char *setting_name = SQ2OTTD(sq_setting_name);
+	ValidateString(setting_name);
 
 	ScriptConfigItem *config = NULL;
 	for (ScriptConfigItemList::iterator it = this->config_list.begin(); it != this->config_list.end(); it++) {
@@ -255,6 +260,7 @@ SQInteger ScriptInfo::AddLabels(HSQUIRRELVM vm)
 		const char *key_string = SQ2OTTD(sq_key);
 		int key = atoi(key_string + 1);
 		const char *label = SQ2OTTD(sq_label);
+		ValidateString(label);
 
 		/* !Contains() prevents strdup from leaking. */
 		if (!config->labels->Contains(key)) config->labels->Insert(key, strdup(label));
diff --git a/src/script/squirrel.cpp b/src/script/squirrel.cpp
index ed87d487c..7c684d4b8 100644
--- a/src/script/squirrel.cpp
+++ b/src/script/squirrel.cpp
@@ -14,6 +14,7 @@
 #include "../debug.h"
 #include "squirrel_std.hpp"
 #include "../fileio_func.h"
+#include "../string_func.h"
 #include <sqstdaux.h>
 #include <../squirrel/sqpcheader.h>
 #include <../squirrel/sqvm.h>
@@ -252,6 +253,7 @@ bool Squirrel::CallStringMethodStrdup(HSQOBJECT instance, const char *method_nam
 	if (!this->CallMethod(instance, method_name, &ret, suspend)) return false;
 	if (ret._type != OT_STRING) return false;
 	*res = strdup(ObjectToString(&ret));
+	ValidateString(*res);
 	return true;
 }
 
diff --git a/src/string.cpp b/src/string.cpp
index b543ab868..39fc8479c 100644
--- a/src/string.cpp
+++ b/src/string.cpp
@@ -255,6 +255,18 @@ void str_validate(char *str, const char *last, StringValidationSettings settings
 }
 
 /**
+ * Scans the string for valid characters and if it finds invalid ones,
+ * replaces them with a question mark '?'.
+ * @param str the string to validate
+ */
+void ValidateString(const char *str)
+{
+	/* We know it is '\0' terminated. */
+	str_validate(const_cast<char *>(str), str + strlen(str) + 1);
+}
+
+
+/**
  * Checks whether the given string is valid, i.e. contains only
  * valid (printable) characters and is properly terminated.
  * @param str  The string to validate.
diff --git a/src/string_func.h b/src/string_func.h
index 32d3d7e6a..25608889d 100644
--- a/src/string_func.h
+++ b/src/string_func.h
@@ -40,6 +40,8 @@ int CDECL seprintf(char *str, const char *last, const char *format, ...) WARN_FO
 char *CDECL str_fmt(const char *str, ...) WARN_FORMAT(1, 2);
 
 void str_validate(char *str, const char *last, StringValidationSettings settings = SVS_REPLACE_WITH_QUESTION_MARK);
+void ValidateString(const char *str);
+
 void str_fix_scc_encoded(char *str, const char *last);
 void str_strip_colours(char *str);
 bool strtolower(char *str);