[josephcsible]

While that's indeed a bug, for it to be a security vulnerability, wouldn't there also have to be a security boundary involved? Specifically, mapName is always either "w1000b.png" or "w1000.png", so the only way to trigger the buffer overflow would be through the HOME environment variable. But if an attacker can run commands as you with arbitrary environment variables, aren't you already pwned? What would anyone gain by running your program and exploiting it to do something, rather than just doing the thing directly? https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

[im3w1l]

While exploitation is unlikely I think such things are still best avoided because multiple such things can sometimes be chained together.

[sedatk]

> But if an attacker can run commands as you with arbitrary environment variables, aren't you already pwned?

Not unless they have another path for privilege escalation.