commit ffa290d23c4a9b90341306866eb53f5a1b3f19aa
Author:     Simon Howard <fraggle@soulsphere.org>
AuthorDate: Fri Jan 5 20:44:51 2018 +0100
Commit:     Simon Howard <fraggle@soulsphere.org>
CommitDate: Fri Jan 5 20:44:51 2018 +0100

    hexen: Validate strings during header parsing.

    Strings must be terminated with a NUL before the end of the lump is
    reached; if not they are invalid. Check that this really is the case.
---
 src/hexen/p_acs.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/hexen/p_acs.c b/src/hexen/p_acs.c
index ce0d8db9..50e09ed8 100644
--- a/src/hexen/p_acs.c
+++ b/src/hexen/p_acs.c
@@ -447,7 +447,7 @@ static int ReadOffset(void)

 void P_LoadACScripts(int lump)
 {
-    int i;
+    int i, offset;
     acsHeader_t *header;
     acsInfo_t *info;

@@ -500,7 +500,10 @@ void P_LoadACScripts(int lump)

     for (i=0; i<ACStringCount; ++i)
     {
-        ACStrings[i] = (char *) ActionCodeBase + ReadOffset();
+        offset = ReadOffset();
+        ACStrings[i] = (char *) ActionCodeBase + offset;
+        ACSAssert(memchr(ACStrings[i], '\0', ActionCodeSize - offset) != NULL,
+                  "string %d missing terminating NUL", i);
     }

     memset(MapVars, 0, sizeof(MapVars));