Hud saytext message handling can cause buffer overflow

[SamVanheer]

The Hud's saytext message handling can cause a buffer overflow here:

halflife/cl_dll/saytext.cpp

Line 220 in c7240b9

strncpy( g_szLineBuffer[i], pszBuf, max(iBufSize , MAX_CHARS_PER_LINE) );

This copies the incoming text into a buffer. The maximum number of characters is calculated as the greater of the buffer size and the size of the incoming text. This means a sufficiently large piece of text would overflow the buffer.

In practice this will never happen because the maximum size that a user message can be is smaller than the buffer size (192 bytes vs 256), but if that size were ever increased it could become an issue.

To fix this, the code needs to be changed to:

strncpy( g_szLineBuffer[i], pszBuf, min(iBufSize , MAX_CHARS_PER_LINE) );

Though it's probably fine to remove the use of min altogether and just passing MAX_CHARS_PER_LINE instead along with null terminating the buffer.