nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

fix buffer overflow in update_topl

Browse Source 
Buffer overflows could occur when interacting with containers while
inputting or outputting many items.

This commit ensures topline updates do not exceed buffer limits by
checking against TBUFSZ.

Issue reported by k21971 on IRC.
This commit is contained in:
Patric Mueller
2026-05-15 23:32:14 +02:00
parent e11ff5f703
commit 3a0c6f17c7
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/fixes5-0-1.txt
+2
View File
@@ -22,6 +22,8 @@ doc: fix spelling correction in nethack.6
spelling: "Flanian Pobble Bead" to "Flainian Pobble Bead" spelling: "Flanian Pobble Bead" to "Flainian Pobble Bead"
obey statue type gender (gnome king statue in minetn-5) obey statue type gender (gnome king statue in minetn-5)
fix statue and figurine genders in special levels in general fix statue and figurine genders in special levels in general
fix buffer overflow in update_topl when handling multiple items in a
container
Platform- and/or Interface-Specific Fixes Platform- and/or Interface-Specific Fixes
win/tty/topl.c
+2 -1
View File
@@ -261,7 +261,8 @@ update_topl(const char *bp)
n0 = strlen(bp); n0 = strlen(bp);
if ((ttyDisplay->toplin == TOPLINE_NEED_MORE || skip) if ((ttyDisplay->toplin == TOPLINE_NEED_MORE || skip)
&& cw->cury == 0 && cw->cury == 0
&& n0 + (int) strlen(gt.toplines) + 3 < CO - 8 /* room for --More-- */ /* room for --More-- */
&& n0 + (int) strlen(gt.toplines) + 3 < min(CO - 8, TBUFSZ)
&& (notdied = strncmp(bp, "You die", 7)) != 0) { && (notdied = strncmp(bp, "You die", 7)) != 0) {
Strcat(gt.toplines, " "); Strcat(gt.toplines, " ");
Strcat(gt.toplines, bp); Strcat(gt.toplines, bp);