avoid more QBUFSZ buffer overflows
Several places were not using safe_qbuf or anything equivalent to avoid overflowing a QBUFSZ buffer. Add more uses plus one special case. For the current max lengths returned by xname(), I think this is sufficient. This addresses a reported buffer overflow for a "thoroughly rusty thoroughly corroded helm of opposite alignment", plus more.
This commit is contained in:
@@ -308,8 +308,11 @@ register struct obj *obj;
|
||||
const char *aname;
|
||||
short objtyp;
|
||||
|
||||
Sprintf(qbuf, "What do you want to name %s %s?",
|
||||
is_plural(obj) ? "these" : "this", xname(obj));
|
||||
Sprintf(qbuf, "What do you want to name %s ",
|
||||
is_plural(obj) ? "these" : "this");
|
||||
Sprintf(eos(qbuf), "%s?",
|
||||
safe_qbuf(qbuf, sizeof("?"),
|
||||
xname(obj), simple_typename(obj->otyp), ""));
|
||||
getlin(qbuf, buf);
|
||||
if(!*buf || *buf == '\033') return;
|
||||
/* strip leading and trailing spaces; unnames item if all spaces */
|
||||
|
||||
Reference in New Issue
Block a user