fix incorrect lint fix
> if (strlen(simpleoname) > BUFSZ - sizeof "the ") > simpleoname[sizeof "the "] = '\0'; The second line should have been | simpleoname[strlen(simpleoname) - sizeof "the "] = '\0'; but fixing that isn't adequate. The BUFSZ limit is not valid when dealing with object names since xname() leaves room for a prefix so doesn't return the start of a BUFSZ-sized buffer. Strangely enough, the complaint that caused me to add those two lines isn't being triggered any more. Some other change at the same time, perhaps splitting Strcpy(simpleoname, obufp = the(simpleoname)); into obufp = the(simpleoname); Strcpy(simpleoname, obufp); pacified the analyzer. However, it didn't resolve the valid complaint that inserting "the " might result in overflow. I've added a comment about simpleonames(), ansimpleoname(), and thesimpleoname() about the possible overflow, but I don't think that such overflow can actually happen when user-applied object name is being suppressed.
This commit is contained in:
18
src/objnam.c
18
src/objnam.c
@@ -2382,6 +2382,22 @@ Ysimple_name2(struct obj *obj)
|
||||
return s;
|
||||
}
|
||||
|
||||
/*
|
||||
* FIXME:
|
||||
* simpleonames(), ansimpleoname(), and thesimpleoname() need to
|
||||
* know the beginning of the obuf[] they use so that they can
|
||||
* guard against buffer overflow when pluralizing (is that an
|
||||
* actual word?) or inserting "an" or "the".
|
||||
*
|
||||
* minimal_xname() returns a call to xname() which writes into
|
||||
* the middle of its obuf[] then backs up to accomodate a prefix,
|
||||
* so BUFSZ is not a reliable limit for the length of the result.
|
||||
*
|
||||
* [Overflow likely moot. Since the formatted object name has
|
||||
* user-supplied name suppressed, the length is sure to be short
|
||||
* enough to added plural suffix or "an" or "the" prefix.]
|
||||
*/
|
||||
|
||||
/* "scroll" or "scrolls" */
|
||||
char *
|
||||
simpleonames(struct obj *obj)
|
||||
@@ -2407,8 +2423,6 @@ ansimpleoname(struct obj *obj)
|
||||
char *obufp, *simpleoname = simpleonames(obj);
|
||||
int otyp = obj->otyp;
|
||||
|
||||
if (strlen(simpleoname) > BUFSZ - sizeof "the ")
|
||||
simpleoname[sizeof "the "] = '\0';
|
||||
/* prefix with "the" if a unique item, or a fake one imitating same,
|
||||
has been formatted with its actual name (we let minimal_xname() handle
|
||||
any `known' and `dknown' checking necessary) */
|
||||
|
||||
Reference in New Issue
Block a user