PR: Fix memory corruption and undefined behavior in cheat sequence handling

linuxdoom-1.10/m_cheat.c

@@ -40,62 +40,73 @@ static unsigned char	cheat_xlate_table[256];
 // Returns a 1 if the cheat was successful, 0 if failed.
 //
 int
-cht_CheckCheat
-( cheatseq_t*	cht,
-  char		key )
+cht_CheckCheat(cheatseq_t* cht, char key)
 {
     int i;
     int rc = 0;
 
     if (firsttime)
     {
-	firsttime = 0;
-	for (i=0;i<256;i++) cheat_xlate_table[i] = SCRAMBLE(i);
+        firsttime = 0;
+        for (i = 0; i < 256; i++)
+            cheat_xlate_table[i] = (unsigned char)SCRAMBLE(i);
     }
 
     if (!cht->p)
-	cht->p = cht->sequence; // initialize if first time
+        cht->p = cht->sequence;
 
     if (*cht->p == 0)
-	*(cht->p++) = key;
-    else if
-	(cheat_xlate_table[(unsigned char)key] == *cht->p) cht->p++;
+    {
+        *(cht->p++) = key;
+    }
+    else if (cheat_xlate_table[(unsigned char)key] == *cht->p)
+    {
+        cht->p++;
+    }
     else
-	cht->p = cht->sequence;
+    {
+        cht->p = cht->sequence;
+    }
 
     if (*cht->p == 1)
-	cht->p++;
-    else if (*cht->p == 0xff) // end of sequence character
     {
-	cht->p = cht->sequence;
-	rc = 1;
+        cht->p++;
+    }
+    else if (*cht->p == 0xff)
+    {
+        cht->p = cht->sequence;
+        rc = 1;
     }
 
     return rc;
 }
 
 void
-cht_GetParam
-( cheatseq_t*	cht,
-  char*		buffer )
+cht_GetParam(cheatseq_t* cht, char* buffer)
 {
+    unsigned char *p = cht->sequence;
+    unsigned char c;
 
-    unsigned char *p, c;
+    // Find start marker (0x01)
+    while (*p && *p != 1 && *p != 0xff)
+        p++;
 
-    p = cht->sequence;
-    while (*(p++) != 1);
-
-    do
+    if (*p != 1)
     {
-	c = *p;
-	*(buffer++) = c;
-	*(p++) = 0;
+        buffer[0] = '\0';
+        return;
     }
-    while (c && *p!=0xff );
-
-    if (*p==0xff)
-	*buffer = 0;
 
-}
+    p++; // move past 0x01
 
+    // Copy until end marker (0xff)
+    while (*p && *p != 0xff)
+    {
+        c = *p;
+        *buffer++ = c;
+        p++;
+    }
 
+    *buffer = '\0';
+}
+}