avoid more QBUFSZ buffer overflows

Several places were not using safe_qbuf or anything equivalent to avoid
overflowing a QBUFSZ buffer.  Add more uses plus one special case.  For
the current max lengths returned by xname(), I think this is
sufficient.  This addresses a reported buffer overflow for a
"thoroughly rusty thoroughly corroded helm of opposite alignment", plus more.
This commit is contained in:
cohrs
2005-03-18 03:46:20 +00:00
parent acb416abcc
commit 5e7e8a5e5f
4 changed files with 36 additions and 21 deletions

View File

@@ -308,8 +308,11 @@ register struct obj *obj;
const char *aname;
short objtyp;
Sprintf(qbuf, "What do you want to name %s %s?",
is_plural(obj) ? "these" : "this", xname(obj));
Sprintf(qbuf, "What do you want to name %s ",
is_plural(obj) ? "these" : "this");
Sprintf(eos(qbuf), "%s?",
safe_qbuf(qbuf, sizeof("?"),
xname(obj), simple_typename(obj->otyp), ""));
getlin(qbuf, buf);
if(!*buf || *buf == '\033') return;
/* strip leading and trailing spaces; unnames item if all spaces */