That crash also happens in my latest dev build, but only with release builds. Are you sure it's in CL_RequestNextDownload()?
It also happens in Quake2Max, but not in any other engine.
BTW, Com_sprintf() in KMQ2 is buffer-safe and null-terminated.
EDIT: I debugged Quake2Max instead, and that crash happens in both CL_PrepRefresh() and SCR_DrawLoading(). The former is called from CL_RequestNextDownload().
There's an strcpy() call there with a 32-char buffer (mapname) as a target. Vanilla Q2 3.21 and my v3.24 patch do this as well, but it doesn't crash for me (maybe because they're compiled with MSVC6?).
As luck would have it, I'm currently preparing a new public release of KMQ2. So this will be fixed in a public build soon.
Here are the problem lines in case you want to fix this yourself instead of waiting.
In cl_view.cpp->CL_PrepRefresh(), look for this:
Code: Select all
strcpy (mapname, cl.configstrings[CS_MODELS+1] + 5); // skip "maps/"
Replace it with this:
Code: Select all
Q_strncpyz (mapname, cl.configstrings[CS_MODELS+1] + 5, sizeof(mapname)); // skip "maps/"
You may also want to increase the size of the buffer mapname.
In cl_screen.c->SCR_DrawLoading(), look for this:
Code: Select all
strcpy (mapfile, cl.configstrings[CS_MODELS+1] + 5); // skip "maps/"
Replace it with this:
Code: Select all
Q_strncpyz (mapfile, cl.configstrings[CS_MODELS+1] + 5, sizeof(mapfile)); // skip "maps/"
You may also want to increase the size of the buffer mapfile.