nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

hypothetical buffer overruns

Browse Source 
doprtool() and doprinuse() collect the inventory letters of all
applicable items into a buffer capable of holding 52 letters plus
terminator.  It is possible to have more than 52 items (ignoring
gold) so theoretically possible to have more than 52 separate lit
candles.  Guard against that.

The easiest way to get an item in the overflow slot is to carry
52 non-boulders, polymorph into a giant, and pick up a boulder.
Assigning the latter to one of the three weapon slots would not
impact doprtool() but it will impact doprinuse().  However, that
wasn't enough to cause a crash for me; evidently the overflow
clobbered something innocuous.  (52+boulder is not the only way
to get something into slot '#', just the only guaranteed one I
can think of offhand.)

This also removes a bunch of 'register' type qualifiers.
This commit is contained in:
PatR
2021-02-27 17:13:17 -08:00
parent a2046669f4
commit 10a9d358c5
2 changed files with 37 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
doc/fixes37.0
View File

@@ -1,4 +1,4 @@
NHDT-Branch: NetHack-3.7 $:$NHDT-Revision: 1.463 $ $NHDT-Date: 1614291055 2021/02/25 22:10:55 $
NHDT-Branch: NetHack-3.7 $:$NHDT-Revision: 1.465 $ $NHDT-Date: 1614474790 2021/02/28 01:13:10 $
General Fixes and Modified Features
-----------------------------------
@@ -389,6 +389,9 @@ messages when Minetown watchmen become angry could report "you see an angry
guard approaching" even if he was invisible and hero can't see invis
when autopickup is on but disabled due to being inside a shop, have ^X say so
don't force fake player monks to always be male
it was theoretically possible to overflow an internal buffer containing
inventory letters by carrying more than 52 separate lit candles and
using the '(' or '*' commands
Fixes to 3.7.0-x Problems that Were Exposed Via git Repository