From 4b876b1aec1522bccf301901d03fb239c77662f1 Mon Sep 17 00:00:00 2001 From: Pasi Kallinen Date: Mon, 21 Dec 2015 18:18:28 +0200 Subject: [PATCH] Fix findtravelpath buffer overflow Test case: Bigroom, full of boulders, with a single path from travel start to travel end. Boulders (and doors) are added to the travelstep[xy] arrays multiple times, and will overflow the arrays. Original patch via Acehack by Alex Smith --- src/hack.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/hack.c b/src/hack.c index a3886457c..2f45d10fd 100644 --- a/src/hack.c +++ b/src/hack.c @@ -919,6 +919,7 @@ boolean guess; static int ordered[] = { 0, 2, 4, 6, 1, 3, 5, 7 }; /* no diagonal movement for grid bugs */ int dirmax = NODIAG(u.umonnum) ? 4 : 8; + boolean alreadyrepeated = FALSE; for (dir = 0; dir < dirmax; ++dir) { int nx = x + xdir[ordered[dir]]; @@ -932,10 +933,13 @@ boolean guess; /* closed doors and boulders usually * cause a delay, so prefer another path */ if (travel[x][y] > radius - 3) { - travelstepx[1 - set][nn] = x; - travelstepy[1 - set][nn] = y; - /* don't change travel matrix! */ - nn++; + if (!alreadyrepeated) { + travelstepx[1 - set][nn] = x; + travelstepy[1 - set][nn] = y; + /* don't change travel matrix! */ + nn++; + alreadyrepeated = TRUE; + } continue; } }