From f1b2c802e672e5877cbdc2454767d0cff9df058e Mon Sep 17 00:00:00 2001
From: skyrim <skyrim@live.com>
Date: Wed, 30 Jul 2014 22:43:26 +0200
Subject: [PATCH] Fix of a possible buffer overflow

---
 plugins/mapchooser.sma    | 4 ++--
 plugins/mapsmenu.sma      | 4 ++--
 plugins/ns/mapchooser.sma | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/plugins/mapchooser.sma b/plugins/mapchooser.sma
index 52d16a0e..4d3116d2 100755
--- a/plugins/mapchooser.sma
+++ b/plugins/mapchooser.sma
@@ -198,7 +198,7 @@ public voteNextmap()
 			if (++a >= g_mapNums) a = 0
 		
 		g_nextName[g_mapVoteNum] = a
-		pos += format(menu[pos], charsmax(menu), "%d. %a^n", g_mapVoteNum + 1, ArrayGetStringHandle(g_mapName, a));
+		pos += format(menu[pos], charsmax(menu) - pos, "%d. %a^n", g_mapVoteNum + 1, ArrayGetStringHandle(g_mapName, a));
 		mkeys |= (1<<g_mapVoteNum)
 		g_voteCount[g_mapVoteNum] = 0
 	}
@@ -212,7 +212,7 @@ public voteNextmap()
 
 	if ((winlimit + maxrounds) == 0 && (get_cvar_float("mp_timelimit") < get_cvar_float("amx_extendmap_max")))
 	{
-		pos += format(menu[pos], charsmax(menu), "%d. %L^n", SELECTMAPS + 1, LANG_SERVER, "EXTED_MAP", mapname)
+		pos += format(menu[pos], charsmax(menu) - pos, "%d. %L^n", SELECTMAPS + 1, LANG_SERVER, "EXTED_MAP", mapname)
 		mkeys |= (1<<SELECTMAPS)
 	}
 
diff --git a/plugins/mapsmenu.sma b/plugins/mapsmenu.sma
index 9640fcf2..b07ad7bc 100755
--- a/plugins/mapsmenu.sma
+++ b/plugins/mapsmenu.sma
@@ -365,12 +365,12 @@ public actionVoteMapMenu(id, key)
 				for (new c = 0; c < g_voteSelectedNum[id]; ++c)
 				{
 					ArrayGetString(g_mapName, g_voteSelected[id][c], tempMap, charsmax(tempMap));
-					len += format(menuBody[len], charsmax(menuBody), "%d. %s^n", c + 1, tempMap)
+					len += format(menuBody[len], charsmax(menuBody) - len, "%d. %s^n", c + 1, tempMap)
 					keys |= (1<<c)
 				}
 				
 				keys |= (1<<8)
-				len += format(menuBody[len], charsmax(menuBody), "^n9. %L^n", id, "NONE")
+				len += format(menuBody[len], charsmax(menuBody) - len, "^n9. %L^n", id, "NONE")
 			} else {
 				ArrayGetString(g_mapName, g_voteSelected[id][0], tempMap, charsmax(tempMap));
 				len = format(menuBody, charsmax(menuBody), g_coloredMenus ? "\y%L^n%s?^n\w^n1. %L^n2. %L^n" : "%L^n%s?^n^n1. %L^n2. %L^n", id, "CHANGE_MAP_TO", tempMap, id, "YES", id, "NO")
diff --git a/plugins/ns/mapchooser.sma b/plugins/ns/mapchooser.sma
index 0cf587b2..f1ea9d22 100755
--- a/plugins/ns/mapchooser.sma
+++ b/plugins/ns/mapchooser.sma
@@ -126,7 +126,7 @@ public voteNextmap(){
     while( isInMenu(a) )
       if (++a >= g_mapNums) a = 0
     g_nextName[g_mapVoteNum] = a
-    pos += format(menu[pos],511,"%d. %s^n",g_mapVoteNum+1,g_mapName[a])
+    pos += format(menu[pos], charsmax(menu) - pos, "%d. %s^n", g_mapVoteNum + 1, g_mapName[a])
     mkeys |= (1<<g_mapVoteNum)
     g_voteCount[g_mapVoteNum] = 0
   }
@@ -137,7 +137,7 @@ public voteNextmap(){
   get_mapname(mapname,31)
 
   if ( get_cvar_float("mp_timelimit") < get_cvar_float("amx_extendmap_max") ){
-    pos += format(menu[pos],511,"%d. Extend map %s^n",SELECTMAPS+1,mapname)
+    pos += format(menu[pos], charsmax(menu) - pos, "%d. Extend map %s^n", SELECTMAPS+1, mapname)
     mkeys |= (1<<SELECTMAPS)
   }