nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

Amiga: defensive NULL/bounds guards in menus and window creation

Browse Source 
Guard the gd lookup in DoMenuScroll's GADGETUP/MOUSEMOVE branches
so a window with no GadgetID==1 does not deref NULL; match the
existing guards in the keyboard-scroll branches.  In the keyboard
selector and MENU_UNSELECT_ALL paths, only mutate items with
canselect set so a non-selectable header cannot have its str
stomped.  Clamp MENU_LAST_PAGE topidx to >= 0.  Make find_menu_item
return NULL on negative idx instead of the head item.  Guard the
PROMPTFIRST data[] shuffle behind cury > 0.

In amii_destroy_nhwindow's NHW_OVER branch use cw->win with a NULL
guard instead of dereferencing amii_wins[WIN_OVER]->win blindly.
Range-check the type argument to amii_create_nhwindow.  Fix the
*argv_in[1] precedence bug so the -L/-l flag does not deref NULL
when it is the last argument.  Wrap AllocAslRequest result in a
NULL check before AslRequestTags/FreeAslRequest.

Defensively bounds-check the idx argument to DispCol.  Replace
the -25937 signed-int literal in clipwin's PropInfo with the
equivalent UWORD value 39599.  Simplify amii_start_menu's free
loop; switch DoMenuScroll's inventory title and Count display to
Snprintf, and stop passing countString to pline as a format.
This commit is contained in:
Ingo Paschke
2026-05-12 15:27:13 +02:00
parent 15e3973ac2
commit 252ca5bef7
4 changed files with 56 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sys/amiga/winamenu.c
+23 -11
View File
@@ -32,8 +32,7 @@ amii_start_menu(winid window, unsigned long mbehavior UNUSED)
cw->data = NULL;
}
for (mip = cw->menu.items, i = 0;
(mip = cw->menu.items) && i < cw->menu.count; ++i) {
while ((mip = cw->menu.items) != NULL) {
cw->menu.items = mip->next;
free(mip);
}
@@ -149,11 +148,13 @@ amii_end_menu(winid window, const char *morestr)
cw->menu.last->next = cw->menu.items;
cw->menu.items = cw->menu.last;
cw->menu.last = mip;
t = cw->data[cw->cury - 1];
for (i = cw->cury - 1; i > 0; i--) {
cw->data[i] = cw->data[i - 1];
if (cw->cury > 0) {
t = cw->data[cw->cury - 1];
for (i = cw->cury - 1; i > 0; i--) {
cw->data[i] = cw->data[i - 1];
}
cw->data[0] = t;
}
cw->data[0] = t;
#endif
}
@@ -190,6 +191,8 @@ amii_menu_item *
find_menu_item(struct amii_WinDesc *cw, int idx)
{
amii_menu_item *mip;
if (idx < 0)
return NULL;
for (mip = cw->menu.items; idx > 0 && mip; mip = mip->next)
--idx;
@@ -336,7 +339,8 @@ DoMenuScroll(int win, int blocking, int how, menu_item **retmip)
nw->Screen = HackScreen;
if (win == WIN_INVEN) {
sprintf(title, "%s the %s's Inventory", svp.plname, svp.pl_character);
Snprintf(title, sizeof title, "%s the %s's Inventory",
svp.plname, svp.pl_character);
nw->Title = title;
if (lastinvent.MaxX != 0) {
nw->LeftEdge = lastinvent.MinX;
@@ -606,7 +610,8 @@ DoMenuScroll(int win, int blocking, int how, menu_item **retmip)
if (how == PICK_ANY) {
amip = cw->menu.items;
while (amip) {
if (amip->selected) {
if (amip->canselect && amip->selector
&& amip->selected) {
amip->selected = FALSE;
amip->count = -1;
amip->str[SOFF + 2] = '-';
@@ -738,8 +743,9 @@ DoMenuScroll(int win, int blocking, int how, menu_item **retmip)
} else {
reset_counting = TRUE;
}
sprintf(countString, "Count: %d", count);
pline(countString);
Snprintf(countString, sizeof countString,
"Count: %ld", count);
pline("%s", countString);
}
} else if (code == CTRL('D') || code == CTRL('U')
|| code == MENU_NEXT_PAGE
@@ -761,7 +767,7 @@ DoMenuScroll(int win, int blocking, int how, menu_item **retmip)
if (code == MENU_FIRST_PAGE) {
topidx = 0;
} else if (code == MENU_LAST_PAGE) {
topidx = cw->maxrow - wheight;
topidx = max(0, cw->maxrow - wheight);
} else
for (i = 0; i < endcnt; ++i) {
if (code == CTRL('D') || code == MENU_NEXT_PAGE) {
@@ -851,6 +857,8 @@ DoMenuScroll(int win, int blocking, int how, menu_item **retmip)
} else {
int selected = FALSE;
for (amip = cw->menu.items; amip; amip = amip->next) {
if (!amip->canselect)
continue;
if (amip->selector == code) {
if (how == PICK_ONE)
aredone = 1;
@@ -905,6 +913,8 @@ DoMenuScroll(int win, int blocking, int how, menu_item **retmip)
aredone = 1;
for (gd = w->FirstGadget; gd && gd->GadgetID != 1;)
gd = gd->NextGadget;
if (!gd)
break;
pip = (struct PropInfo *) gd->SpecialInfo;
totalvis = CountLines(win);
@@ -917,6 +927,8 @@ DoMenuScroll(int win, int blocking, int how, menu_item **retmip)
case MOUSEMOVE:
for (gd = w->FirstGadget; gd && gd->GadgetID != 1;)
gd = gd->NextGadget;
if (!gd)
break;
pip = (struct PropInfo *) gd->SpecialInfo;
totalvis = CountLines(win);