From d8598bd6bb9f75867f4a3938482466016b9728d9 Mon Sep 17 00:00:00 2001
From: PatR <rankin@nethack.org>
Date: Sat, 31 Aug 2019 01:38:19 -0700
Subject: [PATCH 1/2] 'O' vs perm_invent (mostly)

Update persistent inventory window if 'implicit_uncursed', 'menucolors',
or 'guicolor' is toggled.  (curses should be changed to use menucolors
instead of guicolor to decide whether menu coloring is used.  Right now
it requires that both be On.)

Also, EDIT_GETLIN was providing junk default response when message type
or menu color looped and prompted for another entry after handling one.

Mixed in with this is a fix for easily induced buffer overflow which
has security ramifications....
---
 doc/fixes36.3 | 11 ++++++++++-
 src/options.c | 45 +++++++++++++++++++++++++++++++++------------
 2 files changed, 43 insertions(+), 13 deletions(-)

diff --git a/doc/fixes36.3 b/doc/fixes36.3
index 8677345fb..2fc55c341 100644
--- a/doc/fixes36.3
+++ b/doc/fixes36.3
@@ -1,4 +1,4 @@
-$NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.104 $ $NHDT-Date: 1567213888 2019/08/31 01:11:28 $
+$NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.105 $ $NHDT-Date: 1567240693 2019/08/31 08:38:13 $
 
 This fixes36.3 file is here to capture information about updates in the 3.6.x
 lineage following the release of 3.6.2 in May 2019. Please note, however,
@@ -127,6 +127,12 @@ when a shape-shifted sandestin was turned to stone, it died and reverted to
 	instead of dying, make it revert to sandestin form with full health
 toggling perm_invent (where supported) while swallowed or underwater didn't
 	necessarily update the persistent inventory window right away
+have 'O' update persistent inventory window if 'implicit_uncursed',
+	'menucolors', or 'guicolors' (curses) is toggled or if menucolors is
+	On and any menu color patterns are added or removed
+'O's "set <option> to what?" could be used to force a buffer overflow
+'O's response to bad 'statuslines' value said "must be 2 and 3" (at one point
+	it was "must be between 2 and 3", change it to "must be 2 or 3")
 
 
 Fixes to Post-3.6.2 Problems that Were Exposed Via git Repository
@@ -162,6 +168,9 @@ EDIT_GETLIN: wizard mode 'monpolycontrol' was using the getlin() answer buffer
 	what kind of monster?" prompt, resulting in "<x,y>" as default answer
 EDIT_GETLIN: when naming an object or a monster use the existing name, if
 	there is one, as the default answer
+EDIT_GETLIN: using 'O' to set message types or menu colors was overloading the
+	answer buffer with other stuff, resulting in bogus default response
+	during repeat prompting
 curses: very tall menus tried to use selector characters a-z, A-Z, and 0-9,
 	but 0-9 should be reserved for counts and if the display was tall
 	enough for more than 62 entries, arbitrary ASCII punctuation got used
diff --git a/src/options.c b/src/options.c
index 2f601df33..50f92ca86 100644
--- a/src/options.c
+++ b/src/options.c
@@ -1,4 +1,4 @@
-/* NetHack 3.6	options.c	$NHDT-Date: 1561682566 2019/06/28 00:42:46 $  $NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.367 $ */
+/* NetHack 3.6	options.c	$NHDT-Date: 1567240693 2019/08/31 08:38:13 $  $NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.369 $ */
 /* Copyright (c) Stichting Mathematisch Centrum, Amsterdam, 1985. */
 /*-Copyright (c) Michael Allison, 2008. */
 /* NetHack may be freely redistributed.  See license for details. */
@@ -3723,7 +3723,7 @@ boolean tinitial, tfrom_file;
             itmp = atoi(op);
         }
         if (itmp < 2 || itmp > 3) {
-            config_error_add("'%s' requires a value of 2 and 3", fullname);
+            config_error_add("'%s' requires a value of 2 or 3", fullname);
             retval = FALSE;
         } else {
             iflags.wc2_statuslines = itmp;
@@ -4052,11 +4052,11 @@ boolean tinitial, tfrom_file;
                     status_initialize(REASSESS_ONLY);
                 context.botl = TRUE;
             } else if (boolopt[i].addr == &flags.invlet_constant
-                       || boolopt[i].addr == &flags.sortpack) {
+                       || boolopt[i].addr == &flags.sortpack
+                       || boolopt[i].addr == &iflags.implicit_uncursed) {
                 if (!flags.invlet_constant)
                     reassign();
-                if (iflags.perm_invent)
-                    update_inventory();
+                update_inventory();
             } else if (boolopt[i].addr == &flags.lit_corridor
                        || boolopt[i].addr == &flags.dark_room) {
                 /*
@@ -4108,6 +4108,9 @@ boolean tinitial, tfrom_file;
                         set_colors();
                 }
 #endif
+            } else if (boolopt[i].addr == &iflags.use_menu_color
+                       || boolopt[i].addr == &iflags.wc2_guicolor) {
+                update_inventory();
 #endif /* TEXTCOLOR */
             }
             return retval;
@@ -4443,7 +4446,7 @@ int
 doset() /* changing options via menu by Per Liboriussen */
 {
     static boolean made_fmtstr = FALSE;
-    char buf[BUFSZ], buf2[BUFSZ] = DUMMY;
+    char buf[BUFSZ];
     const char *name;
     int i = 0, pass, boolcount, pick_cnt, pick_idx, opt_indx;
     boolean *bool_p;
@@ -4618,11 +4621,16 @@ doset() /* changing options via menu by Per Liboriussen */
 
                 if (!special_handling(compopt[opt_indx].name, setinitial,
                                       fromfile)) {
+                    char abuf[BUFSZ];
+
                     Sprintf(buf, "Set %s to what?", compopt[opt_indx].name);
-                    getlin(buf, buf2);
-                    if (buf2[0] == '\033')
+                    abuf[0] = '\0';
+                    getlin(buf, abuf);
+                    if (abuf[0] == '\033')
                         continue;
-                    Sprintf(buf, "%s:%s", compopt[opt_indx].name, buf2);
+                    Sprintf(buf, "%s:", compopt[opt_indx].name);
+                    (void) strncat(eos(buf), abuf,
+                                   (sizeof buf - 1 - strlen(buf)));
                     /* pass the buck */
                     (void) parseoptions(buf, setinitial, fromfile);
                 }
@@ -5126,7 +5134,7 @@ boolean setinitial, setfromfile;
             iflags.menu_headings = mhattr;
     } else if (!strcmp("msgtype", optname)) {
         int opt_idx, nmt, mttyp;
-        char mtbuf[BUFSZ] = DUMMY;
+        char mtbuf[BUFSZ];
 
  msgtypes_again:
         nmt = msgtype_count();
@@ -5134,6 +5142,7 @@ boolean setinitial, setfromfile;
         if (opt_idx == 3) { /* done */
             return TRUE;
         } else if (opt_idx == 0) { /* add new */
+            mtbuf[0] = '\0';
             getlin("What new message pattern?", mtbuf);
             if (*mtbuf == '\033')
                 return TRUE;
@@ -5188,18 +5197,29 @@ boolean setinitial, setfromfile;
         }
     } else if (!strcmp("menu_colors", optname)) {
         int opt_idx, nmc, mcclr, mcattr;
-        char mcbuf[BUFSZ] = DUMMY;
+        char mcbuf[BUFSZ];
 
  menucolors_again:
         nmc = count_menucolors();
         opt_idx = handle_add_list_remove("menucolor", nmc);
         if (opt_idx == 3) { /* done */
  menucolors_done:
-            if (nmc > 0 && !iflags.use_menu_color)
+            /* in case we've made a change which impacts current persistent
+               inventory window; we don't track whether an actual changed
+               occurred, so just assume there was one and that it matters;
+               if we're wrong, a redundant update is cheap... */
+            if (iflags.use_menu_color)
+                update_inventory();
+
+            /* menu colors aren't being used; if any are defined, remind
+               player how to use them */
+            else if (nmc > 0)
                 pline(
     "To have menu colors become active, toggle 'menucolors' option to True.");
             return TRUE;
+
         } else if (opt_idx == 0) { /* add new */
+            mcbuf[0] = '\0';
             getlin("What new menucolor pattern?", mcbuf);
             if (*mcbuf == '\033')
                 goto menucolors_done;
@@ -5212,6 +5232,7 @@ boolean setinitial, setfromfile;
                 wait_synch();
             }
             goto menucolors_again;
+
         } else { /* list (1) or remove (2) */
             int pick_idx, pick_cnt;
             int mc_idx;

From e9aac25922226dccc87da6652b998edbe33b2d1d Mon Sep 17 00:00:00 2001
From: PatR <rankin@nethack.org>
Date: Sat, 31 Aug 2019 10:46:35 -0700
Subject: [PATCH 2/2] fix #H9164 - menu colors for curses perm_invent

Commit e3af33c9db313d288f6b86a35b8ee705376aebfb in June changed
curses handling for perm_invent to strip off doname()'s "a ", "an ",
or "the " prefix in order to shorten inventory entries and get a
couple of significant extra characters before end-of-line truncation.
That had an unintended impact on menu colors pattern matching for
patterns which expected the article prefix.  Do the matching before
stripping off the prefix instead of after so that the matching gives
the same results as when used on a normal inventory menu (even though
this means that from the user's perspective most perm_invent entries
will have invisible text at the start).

Also for menu colors, don't require curses-specific 'guicolor' option
be enabled when the general, more-specific 'menucolors' option exists
to control menu coloring.  (curses was requiring that both be True.)
---
 doc/fixes36.3         |  8 +++++++-
 win/curses/cursinvt.c | 24 +++++++++++++++++-------
 2 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/doc/fixes36.3 b/doc/fixes36.3
index 2fc55c341..58e792bad 100644
--- a/doc/fixes36.3
+++ b/doc/fixes36.3
@@ -1,4 +1,4 @@
-$NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.105 $ $NHDT-Date: 1567240693 2019/08/31 08:38:13 $
+$NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.106 $ $NHDT-Date: 1567273590 2019/08/31 17:46:30 $
 
 This fixes36.3 file is here to capture information about updates in the 3.6.x
 lineage following the release of 3.6.2 in May 2019. Please note, however,
@@ -155,6 +155,10 @@ curses: sometimes the message window would show a blank line after a prompt
 curses: the change to show map in columns 1..79 instead of 2..80 made the
 	highlight for '@' show up in the wrong place if clipped map had been
 	panned horizontally
+curses+'perm_invent': menu coloring patterns which match ordinary inventory
+	menu might fail to match persistent inventory window because leading
+	article and space ("a ", "an ", "the ") is stripped off for brevity;
+	perform the pattern matching tests before stripping doname() prefix
 tty: revert the attempt to fix "message line anomaly: if autodecribe feedback
 	wrapped to second line, the wrapped portion wasn't erased when a
 	shorter line was shown or getpos was dismissed" because it disrupted
@@ -228,6 +232,8 @@ curses+'perm_invent': don't highlight inventory letters since nothing is
 curses+'perm_invent': could crash during restore if game was saved while
 	hero was swallowed (invalid u.ustuck pointer; suppressing attempts to
 	update persistent inventory window during restore hides the problem)
+curses+'perm_invent': menu coloring required that both 'menucolors' and
+	'guicolor' be On; override guicolor with more-specific menucolors
 curses+'popup_dialog': show the text cursor at the end of prompts for single
 	character input
 curses+DUMPLOG: pass along old messages from save file and quest message
diff --git a/win/curses/cursinvt.c b/win/curses/cursinvt.c
index 6cb8cd67c..59b473fcb 100644
--- a/win/curses/cursinvt.c
+++ b/win/curses/cursinvt.c
@@ -60,8 +60,9 @@ curses_add_inv(int y,
                CHAR_P accelerator, attr_t attr, const char *str)
 {
     WINDOW *win = curses_get_nhwin(INV_WIN);
+    boolean save_guicolor;
     int color = NO_COLOR;
-    int x = 0, width, height, available_width,
+    int x = 0, width, height, available_width, stroffset = 0,
         border = curses_window_has_border(INV_WIN) ? 1 : 0;
 
     /* Figure out where to draw the line */
@@ -101,19 +102,22 @@ curses_add_inv(int y,
            persistent inventory window so don't highlight inventory letters */
         wprintw(win, "%c) ", accelerator);
 #endif
-        available_width -= 3;
+        available_width -= 3; /* letter+parenthesis+space */
 
         /* narrow the entries to fit more of the interesting text; do so
            unconditionally rather than trying to figure whether it's needed;
            when 'sortpack' is enabled we could also strip out "<class> of"
            from "<prefix><class> of <item><suffix> but if that's to be done,
-           core ought to do it */
+           core ought to do it;
+           'stroffset': defer skipping the article prefix until after menu
+           color pattern matching has taken place so that the persistent
+           inventory window always gets same coloring as regular inventory */
         if (!strncmpi(str, "a ", 2))
-            str += 2;
+            stroffset = 2;
         else if (!strncmpi(str, "an ", 3))
-            str += 3;
+            stroffset = 3;
         else if (!strncmpi(str, "the ", 4))
-            str +=4;
+            stroffset = 4;
     }
 #if 0 /* FIXME: MENU GLYPHS */
     if (accelerator && glyph != NO_GLYPH && iflags.use_menu_glyphs) {
@@ -138,10 +142,16 @@ curses_add_inv(int y,
     }
     if (color == NO_COLOR)
         color = NONE;
+    /* curses_toggle_color_attr() uses 'guicolor' to decide whether to
+       honor specified color, but persistent inventory window has its own
+       more-specific control, 'menucolors', so override with that here */
+    save_guicolor = iflags.wc2_guicolor;
+    iflags.wc2_guicolor = iflags.use_menu_color;
     curses_toggle_color_attr(win, color, attr, ON);
     /* wattron(win, attr); */
-    wprintw(win, "%.*s", available_width, str);
+    wprintw(win, "%.*s", available_width, str + stroffset);
     /* wattroff(win, attr); */
     curses_toggle_color_attr(win, color, attr, OFF);
+    iflags.wc2_guicolor = save_guicolor;
     wclrtoeol(win);
 }