fix incorrect lint fix
> if (strlen(simpleoname) > BUFSZ - sizeof "the ") > simpleoname[sizeof "the "] = '\0'; The second line should have been | simpleoname[strlen(simpleoname) - sizeof "the "] = '\0'; but fixing that isn't adequate. The BUFSZ limit is not valid when dealing with object names since xname() leaves room for a prefix so doesn't return the start of a BUFSZ-sized buffer. Strangely enough, the complaint that caused me to add those two lines isn't being triggered any more. Some other change at the same time, perhaps splitting Strcpy(simpleoname, obufp = the(simpleoname)); into obufp = the(simpleoname); Strcpy(simpleoname, obufp); pacified the analyzer. However, it didn't resolve the valid complaint that inserting "the " might result in overflow. I've added a comment about simpleonames(), ansimpleoname(), and thesimpleoname() about the possible overflow, but I don't think that such overflow can actually happen when user-applied object name is being suppressed.
This commit is contained in:
+16
-2
@@ -2382,6 +2382,22 @@ Ysimple_name2(struct obj *obj)
|
|||||||
return s;
|
return s;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* FIXME:
|
||||||
|
* simpleonames(), ansimpleoname(), and thesimpleoname() need to
|
||||||
|
* know the beginning of the obuf[] they use so that they can
|
||||||
|
* guard against buffer overflow when pluralizing (is that an
|
||||||
|
* actual word?) or inserting "an" or "the".
|
||||||
|
*
|
||||||
|
* minimal_xname() returns a call to xname() which writes into
|
||||||
|
* the middle of its obuf[] then backs up to accomodate a prefix,
|
||||||
|
* so BUFSZ is not a reliable limit for the length of the result.
|
||||||
|
*
|
||||||
|
* [Overflow likely moot. Since the formatted object name has
|
||||||
|
* user-supplied name suppressed, the length is sure to be short
|
||||||
|
* enough to added plural suffix or "an" or "the" prefix.]
|
||||||
|
*/
|
||||||
|
|
||||||
/* "scroll" or "scrolls" */
|
/* "scroll" or "scrolls" */
|
||||||
char *
|
char *
|
||||||
simpleonames(struct obj *obj)
|
simpleonames(struct obj *obj)
|
||||||
@@ -2407,8 +2423,6 @@ ansimpleoname(struct obj *obj)
|
|||||||
char *obufp, *simpleoname = simpleonames(obj);
|
char *obufp, *simpleoname = simpleonames(obj);
|
||||||
int otyp = obj->otyp;
|
int otyp = obj->otyp;
|
||||||
|
|
||||||
if (strlen(simpleoname) > BUFSZ - sizeof "the ")
|
|
||||||
simpleoname[sizeof "the "] = '\0';
|
|
||||||
/* prefix with "the" if a unique item, or a fake one imitating same,
|
/* prefix with "the" if a unique item, or a fake one imitating same,
|
||||||
has been formatted with its actual name (we let minimal_xname() handle
|
has been formatted with its actual name (we let minimal_xname() handle
|
||||||
any `known' and `dknown' checking necessary) */
|
any `known' and `dknown' checking necessary) */
|
||||||
|
|||||||
Reference in New Issue
Block a user