Merge branch 'NetHack-3.6'

README

@@ -7,6 +7,7 @@ NetHack 3.6.
 NetHack 3.7.0 work-in-progress is not a release of NetHack. As a .0 version,
 and still very early in its development cycle, there has already been changes
 made, and there will continue to be many more prior to an eventual release.
+section.
 
 In short -- there are likely to be bugs. Don't treat NetHack-3.7 branch as
 released code, and if stability is paramount, then the most recent 
@@ -68,13 +69,13 @@ Please read items (1), (2) and (3) BEFORE doing anything with your new code.
     call it.
 
 2.  Having unpacked, you should have a file called 'Files' in your Top
-    directory.  
+    directory.
 
     This file contains the list of all the files you now SHOULD
     have in each directory.  Please check the files in each directory
     against this list to make sure that you have a complete set.
 
-    This file also contains a list of what files are created during 
+    This file also contains a list of what files are created during
     the build process.
 
     The names of the directories listed should not be changed unless you
@@ -104,7 +105,7 @@ Please read items (1), (2) and (3) BEFORE doing anything with your new code.
     At the time of the most recent official release, NetHack 3.6, it had
     been tested to run/compile on:
 
-        Intel Pentium or better (or clone) running Linux, BSDI, or 
+        Intel Pentium or better (or clone) running Linux, BSDI, or
                 Windows (7 through 10)
         Intel 80386 or greater (or clone) boxes running Linux, or BSDI
 	Mac OS X 10.11 (follow the instructions in sys/unix, not sys/mac)
@@ -114,8 +115,8 @@ Please read items (1), (2) and (3) BEFORE doing anything with your new code.
         msdos protected mode using djgpp including a Linux-host djgpp 
         cross-compile
 
-    Previous versions of NetHack were tested and known to run on the 
+    Previous versions of NetHack were tested and known to run on the
-    following systems, but it is unknown if they can still build and 
+    following systems, but it is unknown if they can still build and
     execute NetHack 3.6 or NetHack 3.7:
 
         Apple Macintosh running MacOS 7.5 or higher, LinuxPPC, BeOS 4.0
@@ -168,7 +169,7 @@ Please read items (1), (2) and (3) BEFORE doing anything with your new code.
 
                         - - - - - - - - - - -
 
-If you have problems building the game, or you find bugs in it, we recommend 
+If you have problems building the game, or you find bugs in it, we recommend
 filing a bug report from our "Contact Us" web page at:
     https://www.nethack.org/common/contact.html
 Please include the version information from #version or the command line
@@ -182,12 +183,12 @@ available can be obtained via git here:
 
 When sending correspondence, please observe the following:
 o Please be sure to include your machine type, OS, and patchlevel.
-o Please avoid sending us binary files (e.g. save files or bones files). 
+o Please avoid sending us binary files (e.g. save files or bones files).
   If you have found a bug and think that your save file would aid in solving
-  the problem, send us a description in words of the problem, your machine 
+  the problem, send us a description in words of the problem, your machine
-  type, your operating system, and the version of NetHack.  Tell us that you 
+  type, your operating system, and the version of NetHack.  Tell us that you
   have a save file, but do not actually send it.
-  You may then be contacted by a member of the development team with the 
+  You may then be contacted by a member of the development team with the
   address of a specific person to send the save file to.
 o Though we make an effort to reply to each bug report, it may take some
   time before you receive feedback.  This is especially true during the
@@ -196,16 +197,16 @@ o We don't give hints for playing the game.
 o Don't bother to ask when the next version will be out or you can expect
   to receive a stock answer.
 
-If you want to submit a patch for the NetHack source code via email directly, 
+If you want to submit a patch for the NetHack source code via email directly,
 you can direct it to this address:
     nethack-bugs (at) nethack.org
 
-If a feature is not accepted you are free, of course, to post the patches 
+If a feature is not accepted you are free, of course, to post the patches
 to the net yourself and let the marketplace decide their worth.
 
 All of this amounts to the following:  If you decide to apply a free-lanced
 patch to your 3.6 code, you are welcome to do so, of course, but we won't
-be able to provide support or receive bug reports for it.  
+be able to provide support or receive bug reports for it.
 
 In our own patches, we will assume that your code is synchronized with ours.
 

dat/history

@@ -223,6 +223,9 @@ for decades, joined the NetHack Development Team in late May 2019.
 NetHack 3.6.3 was released on December 5, 2019 containing over 190 bug
 fixes to NetHack 3.6.2.
 
+NetHack 3.6.4 was released on December 17, 2019 containing a security
+fix and a few bug fixes.
+
 The official NetHack web site is maintained by Ken Lorber at
 http://www.nethack.org/.
 

doc/Guidebook.mn

@@ -24,7 +24,7 @@
 .ds vr "NetHack 3.7
 .ds f0 "\*(vr
 .ds f1
-.ds f2 "December 5, 2019
+.ds f2 "December 17, 2019
 .
 .\" A note on some special characters:
 .\" \(lq = left double quote
@@ -5162,6 +5162,9 @@ participant for decades, joined the NetHack Development Team in late May 2019.
 NetHack 3.6.3 was released on December 5, 2019 containing over 190 bug
 fixes to NetHack 3.6.2.
 .pg
+NetHack 3.6.4 was released on December 17, 2019 containing a security fix
+and a few bug fixes.
+.pg
 The official NetHack web site is maintained by \fBKen Lorber\fP
 at
 .UR https://www.nethack.org/ .

doc/Guidebook.tex

@@ -45,7 +45,7 @@
 %.au
 \author{Original version - Eric S. Raymond\\
 (Edited and expanded for 3.6 by Mike Stephenson and others)}
-\date{December 5, 2019}
+\date{December 17, 2019}
 
 \maketitle
 
@@ -5765,6 +5765,11 @@ for decades, joined the {\it NetHack Development Team} in late May 2019.
 NetHack 3.6.3 was released on December 5, 2019 containing over 190 bug
 fixes to NetHack 3.6.2.
 
+%.pg
+\medskip
+NetHack 3.6.4 was released on December 17, 2019 containing a security fix and
+a few bug fixes.
+
 %.pg
 \medskip
 \nd The official {\it NetHack\/} web site is maintained by {\it Ken Lorber} at

doc/fixes36.4

@@ -1,8 +1,8 @@
 $NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.4 $ $NHDT-Date: 1576287569 2019/12/14 01:39:29 $
 
-This fixes36.4 file is here to capture information about updates in the 3.6.x
+fixes36.4 contains a terse summary of changes made to 3.6.3 in order to
-lineage following the release of 3.6.3 in December 2019.  Hypothetical version
+produce 3.6.4.
-3.6.4 may not be released, in which case these fixes will appear in 3.7.0.
+ 
 
 General Fixes and Modified Features
 -----------------------------------
@@ -15,11 +15,7 @@ message "your knapsack can't accomodate any more items" when picking stuff up
 	or removing such from container was inaccurate if there was some gold
 	pending; vary the message rather than add more convoluted pickup code
 dozen-ish assorted spelling/typo fixes in messages and source comments
-flying hero could not use a hole deliberately with '>'
+fix potential buffer overflow when parsing run-time configuration file
-
-
-Fixes to Post-3.6.3 Problems that Were Exposed Via git Repository
-------------------------------------------------------------------
 
 
 Platform- and/or Interface-Specific Fixes or Features
@@ -30,13 +26,6 @@ allow run-from-removable-device on Windows
 
 General New Features
 --------------------
-
+none
-
-NetHack Community Patches (or Variation) Included
--------------------------------------------------
-
-
-Code Cleanup and Reorganization
--------------------------------
 
 

include/patchlevel.h

@@ -44,6 +44,15 @@
 /****************************************************************************/
 /* Version 3.6.x */
 
+/*  Patch 4, December 17, 2019
+ *  GDBPATH and GREPPATH from sysconf or -D... on compilation command line were
+ *      being processed even if PANICTRACE was disabled but only being freed
+ *      at end of game when that was enabled
+ *  fix the article used in the message when your steed encounters a polymorph trap
+ *  dozen-ish assorted spelling/typo fixes in messages and source comments
+ *  fix potential buffer overflow when parsing run-time configuration file
+ */
+
 /*  Patch 3, December 5, 2019
  *
  *  Fixed stale 'thrownobj' pointer for returning thrown aklys while engulfed

src/files.c

@@ -2441,10 +2441,14 @@ char *origbuf;
     int len;
     boolean retval = TRUE;
 
+    while (*origbuf == ' ' || *origbuf == '\t') /* skip leading whitespace */
+        ++origbuf;                   /* (caller probably already did this) */
+    (void) strncpy(buf, origbuf, sizeof buf - 1);
+    buf[sizeof buf - 1] = '\0'; /* strncpy not guaranteed to NUL terminate */
     /* convert any tab to space, condense consecutive spaces into one,
        remove leading and trailing spaces (exception: if there is nothing
        but spaces, one of them will be kept even though it leads/trails) */
-    mungspaces(strcpy(buf, origbuf));
+    mungspaces(buf);
 
     /* find the '=' or ':' */
     bufp = find_optparam(buf);
@@ -3170,7 +3174,11 @@ boolean
 proc_wizkit_line(buf)
 char *buf;
 {
-    struct obj *otmp = readobjnam(buf, (struct obj *) 0);
+    struct obj *otmp;
+
+    if (strlen(buf) >= BUFSZ)
+        buf[BUFSZ - 1] = '\0';
+    otmp = readobjnam(buf, (struct obj *) 0);
 
     if (otmp) {
         if (otmp != &cg.zeroobj)
@@ -3278,22 +3286,23 @@ boolean FDECL((*proc), (char *));
 
                 /* merge now read line with previous ones, if necessary */
                 if (!ignoreline) {
-                    len = (int) strlen(inbuf) + 1;
+                    len = (int) strlen(ep) + 1; /* +1: final '\0' */
                     if (buf)
-                        len += (int) strlen(buf);
+                        len += (int) strlen(buf) + 1; /* +1: space */
                     tmpbuf = (char *) alloc(len);
+                    *tmpbuf = '\0';
                     if (buf) {
-                        Sprintf(tmpbuf, "%s %s", buf, inbuf);
+                        Strcat(strcpy(tmpbuf, buf), " ");
                         free(buf);
-                    } else
+                    }
-                        Strcpy(tmpbuf, inbuf);
+                    buf = strcat(tmpbuf, ep);
-                    buf = tmpbuf;
+                    buf[sizeof inbuf - 1] = '\0';
                 }
 
                 if (morelines || (ignoreline && !oldline))
                     continue;
 
-                if (handle_config_section(ep)) {
+                if (handle_config_section(buf)) {
                     free(buf);
                     buf = (char *) 0;
                     continue;
@@ -3315,11 +3324,11 @@ boolean FDECL((*proc), (char *));
                     }
                     bufp++;
                     if (g.config_section_chosen)
-                        free(g.config_section_chosen);
+                        free(g.config_section_chosen), g.config_section_chosen = 0;
                     section = choose_random_part(bufp, ',');
-                    if (section)
+                    if (section) {
                         g.config_section_chosen = dupstr(section);
-                    else {
+                    } else {
                         config_error_add("No config section to choose");
                         rv = FALSE;
                     }
@@ -3431,6 +3440,8 @@ int which_set;
     struct symparse *symp;
     char *bufp, *commentp, *altp;
 
+    if (strlen(buf) >= BUFSZ)
+        buf[BUFSZ - 1] = '\0';
     /* convert each instance of whitespace (tabs, consecutive spaces)
        into a single space; leading and trailing spaces are stripped */
     mungspaces(buf);

src/windows.c

@@ -1155,7 +1155,7 @@ boolean fullsubs; /* True -> full substitution for file name, False ->
                 else
                     Strcpy(tmpbuf, "{current date+time}");
                 break;
-            case 'v': /* version, eg. "3.6.3-0" */
+            case 'v': /* version, eg. "3.6.4-0" */
                 Sprintf(tmpbuf, "%s", version_string(verbuf));
                 break;
             case 'u': /* UID */

sys/amiga/.gitattributes

@@ -1,2 +1,2 @@
 *.p NHSUBST
-* NH_filestag=(file%s_for_Amiga_versions_-_untested_for_3.6.3)
+* NH_filestag=(file%s_for_Amiga_versions_-_untested_for_3.6.4)

sys/atari/.gitattributes

@@ -1 +1 @@
-* NH_filestag=(file%s_for_Atari_version_-_untested_for_3.6.3)
+* NH_filestag=(file%s_for_Atari_version_-_untested_for_3.6.4)

sys/be/.gitattributes

@@ -1 +1 @@
-* NH_filestag=(file%s_for_BeOS_version_-_untested_for_3.6.3)
+* NH_filestag=(file%s_for_BeOS_version_-_untested_for_3.6.4)

sys/msdos/.gitattributes

@@ -4,6 +4,6 @@ Makefile.* NHSUBST
 Install.* NHSUBST
 moveinit.pat NH_header=no
 vesa.h NH_header=no
-* NH_filestag=(file%s_for_MSDOS_version_-_tested_for_3.6.3_via_cross-compile_only)
+* NH_filestag=(file%s_for_MSDOS_version_-_tested_for_3.6.4_via_partial_cross-compile_only)
 nhico.uu NH_filestag=(file%s_for_running_MSDOS_binary_under_Windows)
 nhpif.uu NH_filestag=>nhico.uu

sys/os2/.gitattributes

@@ -1,2 +1,2 @@
 Makefile.* NHSUBST
-* NH_filestag=(file%s_for_OS/2_version_-_untested_for_3.6.3)
+* NH_filestag=(file%s_for_OS/2_version_-_untested_for_3.6.4)

sys/share/.gitattributes

@@ -5,16 +5,16 @@ dgn_comp.h NH_header=no
 lev_comp.h NH_header=no
 Makefile.lib NH_header=no
 
-Makefile.lib	NH_filestag=(file%s_for_MSDOS_and_OS/2_versions_-_untested_for_3.6.3)
+Makefile.lib	NH_filestag=(file%s_for_MSDOS_and_OS/2_versions_-_untested_for_3.6.4)
-#termcap.uu NH_filestag=(file%s_for_MSDOS_and_OS/2_versions_-_untested_for_3.6.3)
+#termcap.uu NH_filestag=(file%s_for_MSDOS_and_OS/2_versions_-_untested_for_3.6.4)
 termcap.uu	NH_filestag=>Makefile.lib
 
-pcmain.c	NH_filestag=(file_for_MSDOS,_OS/2,_Amiga,_and_Atari_versions_-_untested_for_3.6.3)
+pcmain.c	NH_filestag=(file_for_MSDOS,_OS/2,_Amiga,_and_Atari_versions_-_untested_for_3.6.4)
 
-pcsys.c		NH_filestag=(file%s_for_MSDOS,_OS/2_and_Atari_versions_-_tested_on_MSDOS_for_3.6.3_via_cross-compile_only)
+pcsys.c		NH_filestag=(file%s_for_MSDOS,_OS/2_and_Atari_versions_-_tested_on_MSDOS_for_3.6.4_via_partial_cross-compile_only)
 pcunix.c	NH_filestag=>pcsys.c
 
-NetHack.cnf	NH_filestag=(file_for_MSDOS,_OS/2,_and_Atari_versions_-_untested_for_3.6.3)
+NetHack.cnf	NH_filestag=(file_for_MSDOS,_OS/2,_and_Atari_versions_-_untested_for_3.6.4)
 pctty.c		NH_filestag=>NetHack.cnf
 
 ioctl.c		NH_filestag=(file%s_for_UNIX_and_Be_versions)

sys/unix/README.linux

@@ -26,8 +26,8 @@ home directory you might perform these steps.
 
 If you have old record and logfile entries from a previous NetHack version,
 you might want to save copies before they get overwritten by the new empty
-files; old saved games and bones files from 3.6.0 through to 3.6.2 should
+files; old saved games and bones files from 3.6.0 through to 3.6.3 should
-work with 3.6.3 but even older saved games and bones files from 3.4.3 will
+work with 3.6.4 but even older saved games and bones files from 3.4.3 will
 not. If you are installing from the RPM, there is no need to save the old
 record and logfile; they are automatically preserved.
 

sys/unix/sysconf

@@ -95,7 +95,7 @@ MAXPLAYERS=10
 # Only available if NetHack was compiled with DUMPLOG
 # Allows following placeholders:
 #   %% literal '%'
-#   %v version (eg. "3.6.3-0")
+#   %v version (eg. "3.6.4-0")
 #   %u game UID
 #   %t game start time, UNIX timestamp format
 #   %T current time, UNIX timestamp format

sys/wince/.gitattributes

@@ -1,4 +1,4 @@
 *.ce NHSUBST
 *.mak NHSUBST
 *.bat NHSUBST
-* NH_filestag=(file%s_for_Windows_CE_and_PocketPC_-_untested_for_3.6.3)
+* NH_filestag=(file%s_for_Windows_CE_and_PocketPC_-_untested_for_3.6.4)

sys/wince/ceinc/.gitattributes

@@ -1 +1 @@
-* NH_filestag=(header_file%s_for_Windows_CE_and_PocketPC_-_untested_for_3.6.3)
+* NH_filestag=(header_file%s_for_Windows_CE_and_PocketPC_-_untested_for_3.6.4)

sys/wince/winhack.rc

@@ -284,8 +284,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 3,6,3,0
+ FILEVERSION 3,6,4,0
- PRODUCTVERSION 3,6,3,0
+ PRODUCTVERSION 3,6,4,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x9L
@@ -300,17 +300,17 @@ BEGIN
     BEGIN
         BLOCK "040904b0"
         BEGIN
-            VALUE "Comments", "NetHack 3.6.3 for Windows CE\0"
+            VALUE "Comments", "NetHack 3.6.4 for Windows CE\0"
             VALUE "CompanyName", " \0"
             VALUE "FileDescription", "nethackm\0"
-            VALUE "FileVersion", "3, 6, 3, 0\0"
+            VALUE "FileVersion", "3, 6, 4, 0\0"
             VALUE "InternalName", "nethackm\0"
             VALUE "LegalCopyright", "Copyright © 1985-2019\0"
             VALUE "LegalTrademarks", "\0"
             VALUE "OriginalFilename", "nethackm.exe\0"
             VALUE "PrivateBuild", "090914\0"
             VALUE "ProductName", "NetHack\0"
-            VALUE "ProductVersion", "3, 6, 3, 0\0"
+            VALUE "ProductVersion", "3, 6, 4, 0\0"
             VALUE "SpecialBuild", "\0"
         END
     END

sys/wince/winhcksp.rc

@@ -260,8 +260,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 3,6,3,0
+ FILEVERSION 3,6,4,0
- PRODUCTVERSION 3,6,3,0
+ PRODUCTVERSION 3,6,4,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x9L
@@ -276,17 +276,17 @@ BEGIN
     BEGIN
         BLOCK "040904b0"
         BEGIN
-            VALUE "Comments", "NetHack 3.6.3 for Smartphone 2002\0"
+            VALUE "Comments", "NetHack 3.6.4 for Smartphone 2002\0"
             VALUE "CompanyName", " \0"
             VALUE "FileDescription", "nethackm\0"
-            VALUE "FileVersion", "3, 6, 3, 0\0"
+            VALUE "FileVersion", "3, 6, 4, 0\0"
             VALUE "InternalName", "nethackm\0"
             VALUE "LegalCopyright", "Copyright © 1985-2019\0"
             VALUE "LegalTrademarks", "\0"
             VALUE "OriginalFilename", "nethackm.exe\0"
             VALUE "PrivateBuild", "090914\0"
             VALUE "ProductName", "NetHack For Smartphone\0"
-            VALUE "ProductVersion", "3, 6, 3, 0\0"
+            VALUE "ProductVersion", "3, 6, 4, 0\0"
             VALUE "SpecialBuild", "\0"
         END
     END

sys/winnt/Install.nt

@@ -16,7 +16,7 @@ contributed the port.
 
 Alex Kompel, Dion Nicolaas, Yitzhak Sapir, Derek S. Ray, Michael Allison,
 Pasi Kallinen, Bart House, and Janet Walz contributed to the maintainance
-of the tty and graphical windows versions of NetHack 3.6.3.
+of the tty and graphical windows versions of NetHack 3.6.4.
 
 You can build a TTY version of NetHack and a Windows Graphical 
 version.  You can use one of the following build environments:
@@ -151,7 +151,7 @@ a 32-bit x86 version, or a 64-bit x64 version.  The default Makefile
 is set up for a 32-bit x86 version, but that's only because it will 
 run on the most number of existing Windows environments.
 
-NetHack's save files and bones files in the 3.6.3 release have not yet
+NetHack's save files and bones files in the 3.6.4 release have not yet
 evolved enough to allow them to interchange between the 32-bit version 
 and the 64-bit version (or between different platforms). Hopefully
 that will change in an upcoming release.

sys/winnt/nethack.def

@@ -1,5 +1,5 @@
 NAME		NETHACK
-DESCRIPTION	'NetHack 3.6.3 for Windows'
+DESCRIPTION	'NetHack 3.6.4 for Windows'
 EXETYPE		WINDOWS
 STUB		'WINSTUB.EXE'
 CODE		PRELOAD MOVEABLE DISCARDABLE

sys/winnt/sysconf.template

@@ -77,6 +77,9 @@ WIZARDS=*
 # IMPORTANT: If you change any of these locations, the directories they
 # point at must exist.  NetHack will not create them for you.
 #
+# Before adjusting, you can verify the default locations for files with:
+#       nethack --showpaths
+#
 # The location that users can adjust their config file startup options
 #CONFIGDIR=%USERPROFILE%\NetHack
 #
@@ -88,7 +91,7 @@ WIZARDS=*
 #HACKDIR=%USERPROFILE%\NetHack\3.7
 #
 # The location that level files in progress are stored (writeable)
-LEVELDIR=%USERPROFILE%\AppData\Local\NetHack\3.7
+#LEVELDIR=%USERPROFILE%\AppData\Local\NetHack\3.7
 #
 # The location where saved games are kept (writeable)
 #SAVEDIR=%USERPROFILE%\AppData\Local\NetHack\3.7

util/makedefs.c

@@ -53,7 +53,7 @@
 #endif
 
 #if defined(UNIX) && !defined(LINT) && !defined(GCC_WARN)
-static const char SCCS_Id[] UNUSED = "@(#)makedefs.c\t3.7\t2019/11/19";
+static const char SCCS_Id[] UNUSED = "@(#)makedefs.c\t3.7\t2019/12/17";
 #endif
 
 /* names of files to be generated */

win/gem/.gitattributes

@@ -1 +1 @@
-* NH_filestag=(file%s_for_GEM_versions_-_untested_for_3.6.3)
+* NH_filestag=(file%s_for_GEM_versions_-_untested_for_3.6.4)

win/gnome/.gitattributes

@@ -1 +1 @@
-* NH_filestag=(file%s_for_GNOME_versions_-_untested_for_3.6.3)
+* NH_filestag=(file%s_for_GNOME_versions_-_untested_for_3.6.4)

win/macosx/NetHackGuidebook.applescript

@@ -1,5 +1,5 @@
 #!/usr/bin/osascript
-# NetHack 3.6.3  NetHackGuidebook.applescript $NHDT-Date: 1575245175 2019/12/02 00:06:15 $  $NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.10 $
+# NetHack 3.6  NetHackGuidebook.applescript $NHDT-Date: 1575245175 2019/12/02 00:06:15 $  $NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.10 $
 # Copyright (c) Kenneth Lorber, Kensington, Maryland, 2011
 # NetHack may be freely redistributed.  See license for details.
 

win/win32/mswproc.c

@@ -2316,7 +2316,7 @@ logDebug(const char *fmt, ...)
 /* Reading and writing settings from the registry. */
 #define CATEGORYKEY "Software"
 #define COMPANYKEY "NetHack"
-#define PRODUCTKEY "NetHack 3.6.3"
+#define PRODUCTKEY "NetHack 3.6.4"
 #define SETTINGSKEY "Settings"
 #define MAINSHOWSTATEKEY "MainShowState"
 #define MAINMINXKEY "MainMinX"