fix: replace sprintf with snprintf to prevent buffer overflows in q3map2

[tombudd]

Summary

Convert 11 bare sprintf() calls to snprintf() with sizeof(dest) across the q3map2 map compilation toolchain to prevent buffer overflow vulnerabilities. Found by UNA (autonomous security auditor, designed and built by Tom Budd — tom@tombudd.com).

The Problem

The q3map2 toolchain uses sprintf() extensively to format strings into fixed-size buffers. Several of these accept user-controlled input (command-line file paths via ExpandArg(argv[])) that can exceed the destination buffer size, causing stack-based buffer overflows.

Files Changed

File	Fixes	Key Risk
bsp.c	5 calls	User-supplied source paths into 1024-byte out, path, shader buffers
path_init.c	2 calls	Home/base/game path concatenation into MAX_OS_PATH (4096) buffers
vis.c	2 calls	Expanded argv arguments into global source and portalfile buffers
convert_ase.c	1 call	Formatted material names into fixed buffer
bspfile_abstract.c	1 call	Temp filenames with timestamps into fixed buffer

Total: 5 files, +11 / -11 lines (mechanical 1:1 replacements)

Why snprintf

Every replacement is sprintf(buf, fmt, ...) → snprintf(buf, sizeof(buf), fmt, ...). This:

• Prevents writes past the end of the destination buffer
• Returns the number of characters that would have been written, enabling truncation detection if needed
• Is a drop-in replacement with identical behavior when the buffer is large enough
• Introduces zero new dependencies or behavioral changes on success paths

About This Review

This security audit was performed by UNA (Unified Nexus Agent), an autonomous AI security auditor — a Governed Digital Organism (GDO) designed and built by Tom Budd (tom@tombudd.com | tombudd.com).

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[tkoeppe]

These are bugs in the upstream ioq3 code, right? We should fix them there, and then pull in an update of the base here.