fix buffer overflow in update_topl

Buffer overflows could occur when interacting with containers while
inputting or outputting many items.

This commit ensures topline updates do not exceed buffer limits by
checking against TBUFSZ.

Issue reported by k21971 on IRC.
This commit is contained in:
Patric Mueller
2026-05-15 23:32:14 +02:00
parent e11ff5f703
commit 3a0c6f17c7
2 changed files with 4 additions and 1 deletions
+2 -1
View File
@@ -261,7 +261,8 @@ update_topl(const char *bp)
n0 = strlen(bp);
if ((ttyDisplay->toplin == TOPLINE_NEED_MORE || skip)
&& cw->cury == 0
&& n0 + (int) strlen(gt.toplines) + 3 < CO - 8 /* room for --More-- */
/* room for --More-- */
&& n0 + (int) strlen(gt.toplines) + 3 < min(CO - 8, TBUFSZ)
&& (notdied = strncmp(bp, "You die", 7)) != 0) {
Strcat(gt.toplines, " ");
Strcat(gt.toplines, bp);