Stack corruption when printing edicts

[alexey.lysiuk]

There is a potential write outside of stack buffer inside PR_ValueString() function.
To reproduce, load Oozing Blasphemy with Arcane Dimensions 1.81, and do edicts in console.

It may crash at the following line

quakespasm/Quake/pr_edict.c

Line 321 in 33085c5

 sprintf (line, "%s", PR_GetString(val->string)); 

because of attempt to write more bytes than were "allocated" here

quakespasm/Quake/pr_edict.c

Line 312 in 33085c5

 static char	line[512]; 

Should it allocate a temporary buffer on the heap if stack one is too small?
Or, is it better to just use q_snprintf() to output only value's part?

[Ozkan Sezer]

The wad entry is ridiculously long - q_snprintf is the way to go: will apply this patch shortly

[Ozkan Sezer]

Should be fixed by commit 1c970af