From 3a0c6f17c72bdead48f38fd52080aee55013b266 Mon Sep 17 00:00:00 2001 From: Patric Mueller Date: Fri, 15 May 2026 23:30:29 +0200 Subject: [PATCH] fix buffer overflow in update_topl Buffer overflows could occur when interacting with containers while inputting or outputting many items. This commit ensures topline updates do not exceed buffer limits by checking against TBUFSZ. Issue reported by k21971 on IRC. --- doc/fixes5-0-1.txt | 2 ++ win/tty/topl.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/doc/fixes5-0-1.txt b/doc/fixes5-0-1.txt index 6cd737192..175061880 100644 --- a/doc/fixes5-0-1.txt +++ b/doc/fixes5-0-1.txt @@ -22,6 +22,8 @@ doc: fix spelling correction in nethack.6 spelling: "Flanian Pobble Bead" to "Flainian Pobble Bead" obey statue type gender (gnome king statue in minetn-5) fix statue and figurine genders in special levels in general +fix buffer overflow in update_topl when handling multiple items in a + container Platform- and/or Interface-Specific Fixes diff --git a/win/tty/topl.c b/win/tty/topl.c index a216b3435..b9f9936a8 100644 --- a/win/tty/topl.c +++ b/win/tty/topl.c @@ -261,7 +261,8 @@ update_topl(const char *bp) n0 = strlen(bp); if ((ttyDisplay->toplin == TOPLINE_NEED_MORE || skip) && cw->cury == 0 - && n0 + (int) strlen(gt.toplines) + 3 < CO - 8 /* room for --More-- */ + /* room for --More-- */ + && n0 + (int) strlen(gt.toplines) + 3 < min(CO - 8, TBUFSZ) && (notdied = strncmp(bp, "You die", 7)) != 0) { Strcat(gt.toplines, " "); Strcat(gt.toplines, bp);