nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

Amiga: tighten input/dialog buffer bounds

Browse Source 
Right-size the Intuition string-gadget buffer to BUFSZ so a caller
with a BUFSZ-sized buffer cannot be overflowed.  Enlarge the
amii_yn_function prompt buffer to fit the worst-case query + resp
+ def + trailing space and switch the appends to Snprintf with
remaining-space tracking.  Replace sprintf in amii_display_file's
"Can't display X: Y" path with Snprintf.  In EditColor's Save path
drop the strcpy/strcat chain that could trail off the end of
oname/nname when dirname returned a near-full path; use Snprintf
instead.  Rewrite dirname() to copy first and truncate the copy,
so it no longer briefly NULs the caller's string.
This commit is contained in:
Ingo Paschke
2026-05-12 15:24:15 +02:00
parent d99eeb17c2
commit 15e3973ac2
2 changed files with 37 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sys/amiga/winami.c
+9 -6
View File
@@ -339,7 +339,7 @@ struct NewScreen NewHackScreen = { 0, 0, WIDTH, SCREENHEIGHT, 3, 0,
void
amii_askname(void)
{
char plnametmp[300]; /* From winreq.c: sizeof(StrStringSIBuff) */
char plnametmp[BUFSZ]; /* matches StrStringSIBuff in winreq.c */
*plnametmp = 0;
do {
amii_getlin("Who are you?", plnametmp);
@@ -577,7 +577,7 @@ amii_yn_function(const char *query, const char *resp, char def)
char q;
char rtmp[40];
boolean digit_ok, allow_num;
char prompt[BUFSZ];
char prompt[BUFSZ + QBUFSZ + 16];
struct amii_WinDesc *cw;
if (cw = amii_wins[WIN_MESSAGE])
@@ -592,10 +592,12 @@ amii_yn_function(const char *query, const char *resp, char def)
*rb = '\0';
(void) strncpy(prompt, query, QBUFSZ - 1);
prompt[QBUFSZ - 1] = '\0';
Sprintf(eos(prompt), " [%s]", respbuf);
Snprintf(eos(prompt), sizeof prompt - strlen(prompt),
" [%s]", respbuf);
if (def)
Sprintf(eos(prompt), " (%c)", def);
Strcat(prompt, " ");
Snprintf(eos(prompt), sizeof prompt - strlen(prompt),
" (%c)", def);
Snprintf(eos(prompt), sizeof prompt - strlen(prompt), " ");
pline("%s", prompt);
} else {
amii_putstr(WIN_MESSAGE, 0, query);
@@ -705,7 +707,8 @@ amii_display_file(const char *fn, boolean complain)
if ((fp = dlb_fopen(fn, RDTMODE)) == (dlb *) NULL) {
if (complain) {
sprintf(buf, "Can't display %s: %s", fn, strerror(errno));
Snprintf(buf, sizeof buf,
"Can't display %s: %s", fn, strerror(errno));
amii_addtopl(buf);
}
return;
sys/amiga/winreq.c
+28 -20
View File
@@ -21,8 +21,8 @@ struct IntuiText IText1 = { 3, 0, JAM1, 4, 1, NULL, (UBYTE *) "Cancel",
struct Gadget Gadget2 = { NULL, 9, 15, 56, 10, NULL, RELVERIFY, BOOLGADGET,
(APTR) &Border1, NULL, &IText1, NULL, NULL, 1,
NULL };
UBYTE StrStringSIBuff[300];
struct StringInfo StrStringSInfo = { StrStringSIBuff, UNDOBUFFER, 0, 300, 0,
UBYTE StrStringSIBuff[BUFSZ];
struct StringInfo StrStringSInfo = { StrStringSIBuff, UNDOBUFFER, 0, BUFSZ, 0,
0, 0, 0, 0, 0, 0, 0, NULL };
SHORT BorderVectors2[] = { 0, 0, 439, 0, 439, 11, 0, 11, 0, 0 };
struct Border Border2 = { -1, -1, 3, 0, JAM1, 5, BorderVectors2, NULL };
@@ -187,14 +187,23 @@ EditColor(void)
break;
}
strcpy(oname, dirname((char *) configfile));
if (oname[strlen(oname) - 1] != ':') {
sprintf(nname, "%s/New_NetHack.cnf", oname);
strcat(oname, "/");
strcat(oname, "Old_NetHack.cnf");
} else {
sprintf(nname, "%sNew_NetHack.cnf", oname);
strcat(oname, "Old_NetHack.cnf");
{
size_t olen;
strncpy(oname, dirname((char *) configfile),
sizeof(oname) - 1);
oname[sizeof(oname) - 1] = '\0';
olen = strlen(oname);
if (olen > 0 && oname[olen - 1] != ':') {
Snprintf(nname, sizeof nname,
"%s/New_NetHack.cnf", oname);
Snprintf(oname + olen, sizeof(oname) - olen,
"/Old_NetHack.cnf");
} else {
Snprintf(nname, sizeof nname,
"%sNew_NetHack.cnf", oname);
Snprintf(oname + olen, sizeof(oname) - olen,
"Old_NetHack.cnf");
}
}
nfp = fopen(nname, "w");
@@ -506,20 +515,19 @@ EditClipping(void)
char *
dirname(char *str)
{
char *t, c;
static char dir[300];
char *t;
t = strrchr(str, '/');
strncpy(dir, str, sizeof(dir) - 1);
dir[sizeof(dir) - 1] = '\0';
t = strrchr(dir, '/');
if (!t)
t = strrchr(dir, ':');
if (!t)
t = strrchr(str, ':');
if (!t) {
dir[0] = '\0';
} else {
c = *t;
*t = 0;
strcpy(dir, str);
*t = c;
}
else
*t = '\0';
return (dir);
}