Buffer overflow in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier as derived from the Cube engine allows remote attackers to execute arbitrary code via long streams of input data.