% will be converted to .

[YuanBaian]

static char *MSG_ReadStringExt( sizebuf_t *sb, qboolean bLine )
{
static char string[4096];
int l = 0;

do
{
	// use MSG_ReadByte so -1 is out of bounds
	int c = MSG_ReadByte( sb );

	if( c == 0 ) break;
	else if( bLine && c == '\n' )
		break;

	// translate all fmt spec to avoid crash bugs
	// NOTE: but game strings leave unchanged. see pfnWriteString for details
	if( c == '%' ) c = '.'; // <=========================Why do this?

	string[l] = c;
	l++;
} while( l < sizeof( string ) - 1 );
string[l] = 0; // terminator

return string;

}

[a1batross]

So that they are not misparsed by any printf/scanf-like function. Even though there are no known use of strings-received-from-network as format strings, it's better to be safe than sorry.

However, why do you ask? Is there a genuine use case for that?

[YuanBaian]

So that they are not misparsed by any printf/scanf-like function. Even though there are no known use of strings-received-from-network as format strings, it's better to be safe than sorry.

However, why do you ask? Is there a genuine use case for that?

My AMXX plugin draws HudMessage on the screen to display some progress, which results in the display of % errors as .

[a1batross]

Don't use % then.

[nekonomicon]

HL25 Anniversary Update has similar check on server side:
https://github.com/ValveSoftware/halflife/blob/master/dlls/client.cpp#L609