Blob Blame History Raw
diff -up alienarena-7.33/source/client/menu.c.BAD alienarena-7.33/source/client/menu.c
--- alienarena-7.33/source/client/menu.c.BAD	2010-04-06 11:12:38.098874822 -0400
+++ alienarena-7.33/source/client/menu.c	2010-04-06 11:15:46.511873232 -0400
@@ -6119,7 +6119,9 @@ qboolean PlayerConfig_MenuInit( void )
 	if ( hand->value < 0 || hand->value > 2 )
 		Cvar_SetValue( "hand", 0 );
 
-	strcpy( currentdirectory, skin->string );
+	Q_strncpyz( currentdirectory, Cvar_VariableString ("skin"), sizeof(currentdirectory)-1);
+	// Richard Stanway's Q1 code says there is a buffer overflow here.
+	// strcpy( currentdirectory, skin->string );
 
 	if ( strchr( currentdirectory, '/' ) )
 	{