nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

Fix findtravelpath buffer overflow

Browse Source 
Test case: Bigroom, full of boulders, with a single
path from travel start to travel end. Boulders (and
doors) are added to the travelstep[xy] arrays multiple
times, and will overflow the arrays.

Original patch via Acehack by Alex Smith
This commit is contained in:
Pasi Kallinen
2015-12-21 18:18:40 +02:00
parent 9a2eb370e7
commit 4b876b1aec
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/hack.c
+8 -4
View File
@@ -919,6 +919,7 @@ boolean guess;
static int ordered[] = { 0, 2, 4, 6, 1, 3, 5, 7 }; static int ordered[] = { 0, 2, 4, 6, 1, 3, 5, 7 };
/* no diagonal movement for grid bugs */ /* no diagonal movement for grid bugs */
int dirmax = NODIAG(u.umonnum) ? 4 : 8; int dirmax = NODIAG(u.umonnum) ? 4 : 8;
boolean alreadyrepeated = FALSE;
for (dir = 0; dir < dirmax; ++dir) { for (dir = 0; dir < dirmax; ++dir) {
int nx = x + xdir[ordered[dir]]; int nx = x + xdir[ordered[dir]];
@@ -932,10 +933,13 @@ boolean guess;
/* closed doors and boulders usually /* closed doors and boulders usually
* cause a delay, so prefer another path */ * cause a delay, so prefer another path */
if (travel[x][y] > radius - 3) { if (travel[x][y] > radius - 3) {
travelstepx[1 - set][nn] = x; if (!alreadyrepeated) {
travelstepy[1 - set][nn] = y; travelstepx[1 - set][nn] = x;
/* don't change travel matrix! */ travelstepy[1 - set][nn] = y;
nn++; /* don't change travel matrix! */
nn++;
alreadyrepeated = TRUE;
}
continue; continue;
} }
} }