fix: Replace strcpy with strlcpy to prevent potential buffer overflows

Core/GameEngine/Source/Common/System/Debug.cpp

@@ -381,6 +381,7 @@ void DebugInit(int flags)
 			*(pEnd + 1) = 0;
 		}
 
+		static_assert(ARRAY_SIZE(theLogFileNamePrev) >= ARRAY_SIZE(dirbuf), "Incorrect array size");
 		strcpy(theLogFileNamePrev, dirbuf);
 		strlcat(theLogFileNamePrev, gAppPrefix, ARRAY_SIZE(theLogFileNamePrev));
 		strlcat(theLogFileNamePrev, DEBUG_FILE_NAME_PREV, ARRAY_SIZE(theLogFileNamePrev));
@@ -391,6 +392,7 @@ void DebugInit(int flags)
 		}
 		strlcat(theLogFileNamePrev, ".txt", ARRAY_SIZE(theLogFileNamePrev));
 
+		static_assert(ARRAY_SIZE(theLogFileName) >= ARRAY_SIZE(dirbuf), "Incorrect array size");
 		strcpy(theLogFileName, dirbuf);
 		strlcat(theLogFileName, gAppPrefix, ARRAY_SIZE(theLogFileNamePrev));
 		strlcat(theLogFileName, DEBUG_FILE_NAME, ARRAY_SIZE(theLogFileNamePrev));
@@ -730,9 +732,9 @@ void ReleaseCrash(const char *reason)
 		return; // We are shutting down, and TheGlobalData has been freed.  jba. [4/15/2003]
 	}
 
-	strcpy(prevbuf, TheGlobalData->getPath_UserData().str());
+	strlcpy(prevbuf, TheGlobalData->getPath_UserData().str(), ARRAY_SIZE(prevbuf));
 	strlcat(prevbuf, RELEASECRASH_FILE_NAME_PREV, ARRAY_SIZE(prevbuf));
-	strcpy(curbuf, TheGlobalData->getPath_UserData().str());
+	strlcpy(curbuf, TheGlobalData->getPath_UserData().str(), ARRAY_SIZE(curbuf));
 	strlcat(curbuf, RELEASECRASH_FILE_NAME, ARRAY_SIZE(curbuf));
 
  	remove(prevbuf);
@@ -819,9 +821,9 @@ void ReleaseCrashLocalized(const AsciiString& p, const AsciiString& m)
 	char prevbuf[ _MAX_PATH ];
 	char curbuf[ _MAX_PATH ];
 
-	strcpy(prevbuf, TheGlobalData->getPath_UserData().str());
+	strlcpy(prevbuf, TheGlobalData->getPath_UserData().str(), ARRAY_SIZE(prevbuf));
 	strlcat(prevbuf, RELEASECRASH_FILE_NAME_PREV, ARRAY_SIZE(prevbuf));
-	strcpy(curbuf, TheGlobalData->getPath_UserData().str());
+	strlcpy(curbuf, TheGlobalData->getPath_UserData().str(), ARRAY_SIZE(curbuf));
 	strlcat(curbuf, RELEASECRASH_FILE_NAME, ARRAY_SIZE(curbuf));
 
  	remove(prevbuf);

Core/GameEngine/Source/Common/System/GameMemory.cpp

@@ -2975,7 +2975,7 @@ void MemoryPoolFactory::memoryPoolUsageReport( const char* filename, FILE *appen
 	if( !appendToFileInstead )
 	{
 		char tmp[256];
-		strcpy(tmp,filename);
+		strlcpy(tmp, filename, ARRAY_SIZE(tmp));
 		strlcat(tmp, ".csv", ARRAY_SIZE(tmp));
 		perfStatsFile = fopen(tmp, "w");
 	}

Core/GameEngineDevice/Source/StdDevice/Common/StdLocalFileSystem.cpp

@@ -211,7 +211,6 @@ Bool StdLocalFileSystem::doesFileExist(const Char *filename) const
 void StdLocalFileSystem::getFileListInDirectory(const AsciiString& currentDirectory, const AsciiString& originalDirectory, const AsciiString& searchName, FilenameList & filenameList, Bool searchSubdirectories) const
 {
 
-	char search[_MAX_PATH];
 	AsciiString asciisearch;
 	asciisearch = originalDirectory;
 	asciisearch.concat(currentDirectory);
@@ -227,17 +226,15 @@ void StdLocalFileSystem::getFileListInDirectory(const AsciiString& currentDirect
 	std::replace(fixedDirectory.begin(), fixedDirectory.end(), '\\', '/');
 #endif
 
-	strcpy(search, fixedDirectory.c_str());
-
 	Bool done = FALSE;
 	std::error_code ec;
 
-	auto iter = std::filesystem::directory_iterator(search, ec);
+	auto iter = std::filesystem::directory_iterator(fixedDirectory.c_str(), ec);
 	// The default iterator constructor creates an end iterator
 	done = iter == std::filesystem::directory_iterator();
 
 	if (ec) {
-		DEBUG_LOG(("StdLocalFileSystem::getFileListInDirectory - Error opening directory %s", search));
+		DEBUG_LOG(("StdLocalFileSystem::getFileListInDirectory - Error opening directory %s", fixedDirectory.c_str()));
 		return;
 	}
 

Core/GameEngineDevice/Source/Win32Device/Common/Win32LocalFileSystem.cpp

@@ -127,16 +127,14 @@ void Win32LocalFileSystem::getFileListInDirectory(const AsciiString& currentDire
 	HANDLE fileHandle = NULL;
 	WIN32_FIND_DATA findData;
 
-	char search[_MAX_PATH];
 	AsciiString asciisearch;
 	asciisearch = originalDirectory;
 	asciisearch.concat(currentDirectory);
 	asciisearch.concat(searchName);
-	strcpy(search, asciisearch.str());
 
 	Bool done = FALSE;
 
-	fileHandle = FindFirstFile(search, &findData);
+	fileHandle = FindFirstFile(asciisearch.str(), &findData);
 	done = (fileHandle == INVALID_HANDLE_VALUE);
 
 	while (!done)	{

Core/Libraries/Source/WWVegas/WW3D2/collect.cpp

@@ -1015,7 +1015,8 @@ WW3DErrorType CollectionDefClass::Load(ChunkLoadClass & cload)
 	if (cload.Read(&header,sizeof(header)) != sizeof(header)) goto Error;
 	if (!cload.Close_Chunk()) goto Error;
 
-	strlcpy(Name,header.Name,W3D_NAME_LEN);
+	static_assert(ARRAY_SIZE(Name) >= ARRAY_SIZE(header.Name), "Incorrect array size");
+	strcpy(Name,header.Name);
 	ObjectNames.Resize(header.RenderObjectCount);
 
 	while (cload.Open_Chunk()) {

Core/Libraries/Source/WWVegas/WW3D2/hcanim.cpp

@@ -255,15 +255,17 @@ int HCompressedAnimClass::Load_W3D(ChunkLoadClass & cload)
 
 	cload.Close_Chunk();
 
-	strcpy(Name,aheader.HierarchyName);
+	static_assert(ARRAY_SIZE(Name) >= ARRAY_SIZE(aheader.HierarchyName), "Incorrect array size");
+	strcpy(Name, aheader.HierarchyName);
 	strlcat(Name, ".", ARRAY_SIZE(Name));
 	strlcat(Name, aheader.Name, ARRAY_SIZE(Name));
 
 	// TSS chasing crash bug 05/26/99
    WWASSERT(HierarchyName != NULL);
    WWASSERT(aheader.HierarchyName != NULL);
    WWASSERT(sizeof(HierarchyName) >= W3D_NAME_LEN);
-   strlcpy(HierarchyName,aheader.HierarchyName,W3D_NAME_LEN);
+	 static_assert(ARRAY_SIZE(HierarchyName) >= ARRAY_SIZE(aheader.HierarchyName), "Incorrect array size");
+	 strcpy(HierarchyName, aheader.HierarchyName);
 
 	HTreeClass * base_pose = WW3DAssetManager::Get_Instance()->Get_HTree(HierarchyName);
 	if (base_pose == NULL) {

Core/Libraries/Source/WWVegas/WW3D2/hmdldef.cpp

@@ -148,9 +148,12 @@ int HModelDefClass::Load_W3D(ChunkLoadClass & cload)
 	/*
 	** process the header info
 	*/
-	strlcpy(ModelName,header.Name,W3D_NAME_LEN);
-	strlcpy(BasePoseName,header.HierarchyName,W3D_NAME_LEN);
-	strcpy(Name,ModelName);
+	static_assert(ARRAY_SIZE(ModelName) >= ARRAY_SIZE(header.Name), "Incorrect array size");
+	static_assert(ARRAY_SIZE(BasePoseName) >= ARRAY_SIZE(header.HierarchyName), "Incorrect array size");
+	static_assert(ARRAY_SIZE(Name) >= ARRAY_SIZE(ModelName), "Incorrect array size");
+	strcpy(ModelName, header.Name);
+	strcpy(BasePoseName, header.HierarchyName);
+	strcpy(Name, ModelName);
 
 	/*
 	** Just allocate a node for the number of sub objects we're expecting
@@ -232,7 +235,8 @@ bool HModelDefClass::read_connection(ChunkLoadClass & cload,HmdlNodeDefStruct *
 		return false;
 	}
 
-	strcpy(node->RenderObjName,ModelName);
+	static_assert(ARRAY_SIZE(node->RenderObjName) >= ARRAY_SIZE(ModelName), "Incorrect array size");
+	strcpy(node->RenderObjName, ModelName);
 	strlcat(node->RenderObjName, ".", ARRAY_SIZE(node->RenderObjName));
 	strlcat(node->RenderObjName, con.RenderObjName, ARRAY_SIZE(node->RenderObjName));
 

Core/Libraries/Source/WWVegas/WW3D2/ringobj.cpp

@@ -1206,7 +1206,7 @@ RingPrototypeClass::RingPrototypeClass (void)
 RingPrototypeClass::RingPrototypeClass(RingRenderObjClass *ring)
 {
 	::memset (&Definition, 0, sizeof (Definition));
-	::strcpy (Definition.Name, ring->Get_Name ());
+	strlcpy(Definition.Name, ring->Get_Name(), ARRAY_SIZE(Definition.Name));
 
 	Definition.AnimDuration			= ring->AnimDuration;
 	Definition.Attributes			= ring->Get_Flags ();
@@ -1237,7 +1237,7 @@ RingPrototypeClass::RingPrototypeClass(RingRenderObjClass *ring)
 			filename = name;
 		}
 
-		::strcpy (Definition.TextureName, filename);
+		strlcpy(Definition.TextureName, filename, ARRAY_SIZE(Definition.TextureName));
 	}
 
 	//

Core/Libraries/Source/WWVegas/WW3D2/sphereobj.cpp

@@ -1162,7 +1162,7 @@ SpherePrototypeClass::SpherePrototypeClass (void)
 SpherePrototypeClass::SpherePrototypeClass(SphereRenderObjClass *sphere)
 {
 	::memset (&Definition, 0, sizeof (Definition));
-	::strcpy (Definition.Name, sphere->Get_Name ());
+	strlcpy(Definition.Name, sphere->Get_Name(), ARRAY_SIZE(Definition.Name));
 
 	Definition.DefaultAlpha = sphere->Get_Default_Alpha ();
 	Definition.AnimDuration = sphere->AnimDuration;
@@ -1190,7 +1190,7 @@ SpherePrototypeClass::SpherePrototypeClass(SphereRenderObjClass *sphere)
 			filename = name;
 		}
 
-		::strcpy (Definition.TextureName, filename);
+		strlcpy(Definition.TextureName, filename, ARRAY_SIZE(Definition.TextureName));
 
 	}
 

Core/Libraries/Source/WWVegas/WWDownload/FTP.cpp

@@ -665,7 +665,7 @@
 	char ext[ 10 ];
 
 	if (m_findStart==0)
       m_findStart=time(NULL);
 
 	if((time(NULL)-m_findStart) > 30)  // try for 30 seconds
 	{
@@ -1719,7 +1719,7 @@
 
 	// Concatenate the registry key together
 
-	strcpy( regkey, szRegistryRoot );
+	strlcpy(regkey, szRegistryRoot, ARRAY_SIZE(regkey));
 	if( regkey[ strlen( regkey ) - 1 ] != '\\' )
 	{
 		strlcat(regkey, "\\Download", ARRAY_SIZE(regkey));

Core/Libraries/Source/WWVegas/WWLib/Except.cpp

@@ -903,7 +903,7 @@ void Register_Thread_ID(unsigned long thread_id, char *thread_name, bool main_th
 
 		ThreadInfoType *thread = new ThreadInfoType;
 		thread->ThreadID = thread_id;
-		strcpy(thread->ThreadName, thread_name);
+		strlcpy(thread->ThreadName, thread_name, ARRAY_SIZE(thread->ThreadName));
 		thread->Main = main_thread;
 		thread->ThreadHandle = INVALID_HANDLE_VALUE;
 		ThreadList.Add(thread);

Core/Libraries/Source/WWVegas/WWLib/WWCommon.h

@@ -26,8 +26,13 @@
 
 // This macro serves as a general way to determine the number of elements within an array.
 #ifndef ARRAY_SIZE
-#define ARRAY_SIZE(x) int(sizeof(x)/sizeof(x[0]))
+#if defined(_MSC_VER) && _MSC_VER < 1300
+#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof(arr[0]))
+#else
+template <typename Type, size_t Size> char (*ArraySizeHelper(Type(&)[Size]))[Size];
+#define ARRAY_SIZE(arr) sizeof(*ArraySizeHelper(arr))
 #endif
+#endif // ARRAY_SIZE
 
 enum
 {

Core/Libraries/Source/WWVegas/WWLib/ffactory.cpp

@@ -146,7 +146,7 @@ void SimpleFileFactoryClass::Prepend_Sub_Directory( const char * sub_directory )
 
 	// Ensure sub_directory ends with a slash, and append a semicolon
 	char temp_sub_dir[1024];
-	strcpy(temp_sub_dir, sub_directory);
+	strlcpy(temp_sub_dir, sub_directory, ARRAY_SIZE(temp_sub_dir));
 	if (temp_sub_dir[sub_len - 1] != '\\') {
 		temp_sub_dir[sub_len] = '\\';
 		temp_sub_dir[sub_len + 1] = 0;
@@ -181,7 +181,7 @@ void SimpleFileFactoryClass::Append_Sub_Directory( const char * sub_directory )
 
 	// Ensure sub_directory ends with a slash
 	char temp_sub_dir[1024];
-	strcpy(temp_sub_dir, sub_directory);
+	strlcpy(temp_sub_dir, sub_directory, ARRAY_SIZE(temp_sub_dir));
 	if (temp_sub_dir[sub_len - 1] != '\\') {
 		temp_sub_dir[sub_len] = '\\';
 		temp_sub_dir[sub_len + 1] = 0;

Core/Libraries/Source/WWVegas/WWLib/ini.cpp

@@ -430,7 +430,7 @@ int INIClass::Load(Straw & ffile)
 			if (ptr != NULL) *ptr = '\0';
 			strtrim(buffer);
 			char section[64];
-			strcpy(section, buffer);
+			strlcpy(section, buffer, ARRAY_SIZE(section));
 
 			/*
 			**	Read in the entries of this section.

Core/Libraries/Source/WWVegas/WWLib/registry.cpp

@@ -470,7 +470,7 @@ void RegistryClass::Save_Registry_Tree(char *path, INIClass *ini)
 				** See if there are sub keys.
 				*/
 				char new_key_path[512];
-				strcpy(new_key_path, path);
+				strlcpy(new_key_path, path, ARRAY_SIZE(new_key_path));
 				strlcat(new_key_path, "\\", ARRAY_SIZE(new_key_path));
 				strlcat(new_key_path, name, ARRAY_SIZE(new_key_path));
 
@@ -564,7 +564,7 @@ void RegistryClass::Load_Registry(const char *filename, char *old_path, char *ne
 			** Build the new path to use in the registry.
 			*/
 			char *section_name = section->Section;
-			strcpy(path, new_path);
+			strlcpy(path, new_path, ARRAY_SIZE(path));
 			char *cut = strstr(section_name, old_path);
 			if (cut) {
 				strlcat(path, cut + old_path_len, ARRAY_SIZE(path));
@@ -693,7 +693,7 @@ void RegistryClass::Delete_Registry_Tree(char *path)
 					** See if there are sub keys.
 					*/
 					char new_key_path[512];
-					strcpy(new_key_path, path);
+					strlcpy(new_key_path, path, ARRAY_SIZE(new_key_path));
 					strlcat(new_key_path, "\\", ARRAY_SIZE(new_key_path));
 					strlcat(new_key_path, name, ARRAY_SIZE(new_key_path));
 

Core/Libraries/Source/debug/debug_debug.cpp

@@ -1188,7 +1188,7 @@ void Debug::UpdateFrameStatus(FrameHashEntry &entry)
       entry.frameType==FrameTypeCheck)
     wsprintf(help,"%s(%i)",entry.fileOrGroup,entry.line);
   else
-    strcpy(help,entry.fileOrGroup);
+    strlcpy(help, entry.fileOrGroup, ARRAY_SIZE(help));
 
   // update frame status
   bool active=entry.frameType!=FrameTypeLog;

Core/Libraries/Source/debug/debug_io_flat.cpp

@@ -83,17 +83,15 @@ void DebugIOFlat::OutputStream::Delete(const char *path)
       char help[512];
       if (path[0]&&(path[1]==':'||(path[0]=='\\'&&path[1]=='\\')))
       {
-        strcpy(help,path);
-        strcpy(help+pathLen,fileNameOnly);
-        help[ext-fileNameOnly+pathLen]=0;
+        strlcpy(help, path, ARRAY_SIZE(help));
+        strlcat(help, fileNameOnly, ARRAY_SIZE(help));
       }
       else
       {
         // no, relative path given
-        strcpy(help,m_fileName);
-        strcpy(help+(fileNameOnly-m_fileName),path);
-        strcpy(help+(fileNameOnly-m_fileName)+pathLen,fileNameOnly);
-        help[ext-fileNameOnly+pathLen+(fileNameOnly-m_fileName)]=0;
+        strlcpy(help, m_fileName, ARRAY_SIZE(help));
+        strlcat(help, path, ARRAY_SIZE(help));
+        strlcat(help, fileNameOnly, ARRAY_SIZE(help));
       }
       if (++run)
         wsprintf(help+strlen(help),"(%i)%s",run,ext);
@@ -268,7 +266,7 @@ void DebugIOFlat::ExpandMagic(const char *src, const char *splitName, char *buf)
       case 'n':
       case 'N':
         if (splitName&&strlen(splitName)<250)
-          strcpy(help,splitName);
+          strlcpy(help, splitName, ARRAY_SIZE(help));
         break;
       default:
         *dst++=src[-1];
@@ -277,7 +275,7 @@ void DebugIOFlat::ExpandMagic(const char *src, const char *splitName, char *buf)
     unsigned len=strlen(help);
     if (dst-buf+len>250)
       break;
-    strcpy(dst,help);
+    strcpy(dst, help);
     dst+=len;
   }
   strcpy(dst,".log");
@@ -418,7 +416,7 @@ void DebugIOFlat::Execute(class Debug& dbg, const char *cmd, bool structuredCmd,
     // add [ <filename> [ <size in kb> ] ]
     __ASSERT(m_firstStream==NULL);
 
-    strcpy(m_baseFilename,argn?argv[0]:"*eMN");
+    strlcpy(m_baseFilename, argn?argv[0]:"*eMN", ARRAY_SIZE(m_baseFilename));
 
     char fn[256];
     ExpandMagic(m_baseFilename,NULL,fn);

Generals/Code/GameEngine/Source/Common/INI/INI.cpp

@@ -404,7 +404,7 @@ UnsignedInt INI::load( AsciiString filename, INILoadType loadType, Xfer *pXfer )
 				if (parse)
 				{
 					#ifdef DEBUG_CRASHING
-					strcpy(m_curBlockStart, m_buffer);
+					strlcpy(m_curBlockStart, m_buffer, ARRAY_SIZE(m_curBlockStart));
 					#endif
 					try {
 						(*parse)( this );
@@ -776,7 +776,7 @@ AsciiString INI::getNextQuotedAsciiString()
 			Bool done=FALSE;
 			if ((strLen=strlen(token)) > 1)
 			{
-				strcpy(buff, &token[1]);	//skip the starting quote
+				strlcpy(buff, &token[1], ARRAY_SIZE(buff));	//skip the starting quote
 				//Check for end of quoted string.  Checking here fixes cases where quoted string on same line with other data.
 				if (buff[strLen-2]=='"')	//skip ending quote if present
 				{	buff[strLen-2]='\0';
@@ -825,7 +825,7 @@ AsciiString INI::getNextAsciiString()
 
 			if (strlen(token) > 1)
 			{
-				strcpy(buff, &token[1]);
+				strlcpy(buff, &token[1], ARRAY_SIZE(buff));
 			}
 
 			token = getNextToken(getSepsQuote());

Generals/Code/GameEngine/Source/Common/PerfTimer.cpp

@@ -269,10 +269,10 @@ void PerfGather::reset()
 {
 	PerfGather::termPerfDump();
 
-	strcpy(s_buf, fname);
+	strlcpy(s_buf, fname, ARRAY_SIZE(s_buf);
 
 	char tmp[256];
-	strcpy(tmp, s_buf);
+	strlcpy(tmp, s_buf, ARRAY_SIZE(tmp));
 	strlcat(tmp, ".csv", ARRAY_SIZE(tmp));
 
 	s_perfStatsFile = fopen(tmp, "w");

Generals/Code/GameEngine/Source/GameClient/GUI/GUICallbacks/Menus/WOLLoginMenu.cpp

@@ -1260,9 +1260,9 @@ WindowMsgHandledType WOLLoginMenuSystem( GameWindow *window, UnsignedInt msg,
 							loginAttemptTime = timeGetTime();
 							BuddyRequest req;
 							req.buddyRequestType = BuddyRequest::BUDDYREQUEST_LOGINNEW;
-							strcpy(req.arg.login.nick, login.str());
-							strcpy(req.arg.login.email, email.str());
-							strcpy(req.arg.login.password, password.str());
+							strlcpy(req.arg.login.nick, login.str(), ARRAY_SIZE(req.arg.login.nick));
+							strlcpy(req.arg.login.email, email.str(), ARRAY_SIZE(req.arg.login.email));
+							strlcpy(req.arg.login.password, password.str(), ARRAY_SIZE(req.arg.login.password));
 							req.arg.login.hasFirewall = TRUE;
 
 							TheGameSpyInfo->setLocalBaseName( login );
@@ -1349,9 +1349,9 @@ WindowMsgHandledType WOLLoginMenuSystem( GameWindow *window, UnsignedInt msg,
 							loginAttemptTime = timeGetTime();
 							BuddyRequest req;
 							req.buddyRequestType = BuddyRequest::BUDDYREQUEST_LOGIN;
-							strcpy(req.arg.login.nick, login.str());
-							strcpy(req.arg.login.email, email.str());
-							strcpy(req.arg.login.password, password.str());
+							strlcpy(req.arg.login.nick, login.str(), ARRAY_SIZE(req.arg.login.nick));
+							strlcpy(req.arg.login.email, email.str(), ARRAY_SIZE(req.arg.login.email));
+							strlcpy(req.arg.login.password, password.str(), ARRAY_SIZE(req.arg.login.password));
 							req.arg.login.hasFirewall = true;
 
 							TheGameSpyInfo->setLocalBaseName( login );