security fix: prevent command injection via callvote

code/qcommon/cmd.c

@@ -433,6 +433,22 @@ char *Cmd_Cmd(void)
 	return cmd_cmd;
 }
 
+/*
+   Replace command separators with space to prevent interpretation
+   This is a hack to protect buggy qvms
+   https://bugzilla.icculus.org/show_bug.cgi?id=3593
+*/
+void Cmd_Args_Sanitize( void ) {
+	int i;
+	for ( i = 1 ; i < cmd_argc ; i++ ) {
+		char* c = cmd_argv[i];
+		while ((c = strpbrk(c, "\n\r;"))) {
+			*c = ' ';
+			++c;
+		}
+	}
+}
+
 /*
 ============
 Cmd_TokenizeString