diff --git a/src/objnam.c b/src/objnam.c index d71dd5897..df6b29167 100644 --- a/src/objnam.c +++ b/src/objnam.c @@ -2382,6 +2382,22 @@ Ysimple_name2(struct obj *obj) return s; } + /* + * FIXME: + * simpleonames(), ansimpleoname(), and thesimpleoname() need to + * know the beginning of the obuf[] they use so that they can + * guard against buffer overflow when pluralizing (is that an + * actual word?) or inserting "an" or "the". + * + * minimal_xname() returns a call to xname() which writes into + * the middle of its obuf[] then backs up to accomodate a prefix, + * so BUFSZ is not a reliable limit for the length of the result. + * + * [Overflow likely moot. Since the formatted object name has + * user-supplied name suppressed, the length is sure to be short + * enough to added plural suffix or "an" or "the" prefix.] + */ + /* "scroll" or "scrolls" */ char * simpleonames(struct obj *obj) @@ -2407,8 +2423,6 @@ ansimpleoname(struct obj *obj) char *obufp, *simpleoname = simpleonames(obj); int otyp = obj->otyp; - if (strlen(simpleoname) > BUFSZ - sizeof "the ") - simpleoname[sizeof "the "] = '\0'; /* prefix with "the" if a unique item, or a fake one imitating same, has been formatted with its actual name (we let minimal_xname() handle any `known' and `dknown' checking necessary) */