nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

avoid more QBUFSZ buffer overflows

Browse Source 
Several places were not using safe_qbuf or anything equivalent to avoid
overflowing a QBUFSZ buffer.  Add more uses plus one special case.  For
the current max lengths returned by xname(), I think this is
sufficient.  This addresses a reported buffer overflow for a
"thoroughly rusty thoroughly corroded helm of opposite alignment", plus more.
This commit is contained in:
cohrs
2005-03-18 03:46:20 +00:00
parent acb416abcc
commit 5e7e8a5e5f
4 changed files with 36 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/eat.c
View File

@@ -2552,19 +2552,21 @@ floorfood(verb,corpsecheck) /* get food from floor or pack */
/* Is there some food (probably a heavy corpse) here on the ground? */
for (otmp = level.objects[u.ux][u.uy]; otmp; otmp = otmp->nexthere) {
if(corpsecheck ?
if (corpsecheck ?
(otmp->otyp==CORPSE && (corpsecheck == 1 || tinnable(otmp))) :
feeding ? (otmp->oclass != COIN_CLASS && is_edible(otmp)) :
otmp->oclass==FOOD_CLASS) {
Sprintf(qbuf, "There %s %s here; %s %s?",
otense(otmp, "are"),
doname(otmp), verb,
(otmp->quan == 1L) ? "it" : "one");
if((c = yn_function(qbuf,ynqchars,'n')) == 'y')
return(otmp);
else if(c == 'q')
return((struct obj *) 0);
}
Sprintf(qbuf, "There %s ", otense(otmp, "are"));
Sprintf(eos(qbuf), "%s here; %s %s?",
safe_qbuf(qbuf, sizeof(" here; ...?") + strlen(verb),
doname(otmp), simple_typename(otmp->otyp),
"something"),
verb, (otmp->quan == 1L) ? "it" : "one");
if ((c = yn_function(qbuf,ynqchars,'n')) == 'y')
return(otmp);
else if (c == 'q')
return((struct obj *) 0);
}
}
skipfloor: