nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

#adjust bounds bug

Browse Source 
Noticed while looking at something else:  doorganize() goes out of
array bounds for alphabet[] when inventory contains something in the '#'
slot, or in the '$' slot for GOLDOBJ config.  Both # and $ pass the
(let <= 'Z') test, then produce a negative result for (let - 'A' + 26).
In my case, it was harmlessly clobbering the tail end of buf[] but it
could potentially be a lot worse.
This commit is contained in:
nethack.rankin
2007-06-05 02:45:09 +00:00
parent e08b97597c
commit 8a1d074686
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/invent.c
+8 -6
View File
@@ -1,4 +1,4 @@
/* SCCS Id: @(#)invent.c 3.5 2007/01/02 */ /* SCCS Id: @(#)invent.c 3.5 2007/06/04 */
/* Copyright (c) Stichting Mathematisch Centrum, Amsterdam, 1985. */ /* Copyright (c) Stichting Mathematisch Centrum, Amsterdam, 1985. */
/* NetHack may be freely redistributed. See license for details. */ /* NetHack may be freely redistributed. See license for details. */
@@ -2937,11 +2937,13 @@ doorganize() /* inventory organizer by Del Lamb */
/* blank out all the letters currently in use in the inventory */ /* blank out all the letters currently in use in the inventory */
/* except those that will be merged with the selected object */ /* except those that will be merged with the selected object */
for (otmp = invent; otmp; otmp = otmp->nobj) for (otmp = invent; otmp; otmp = otmp->nobj)
if (otmp != obj && !mergable(otmp,obj)) { if (otmp != obj && !mergable(otmp, obj)) {
if (otmp->invlet <= 'Z') let = otmp->invlet;
alphabet[(otmp->invlet) - 'A' + 26] = ' '; if (let >= 'a' && let <= 'z')
else alphabet[(otmp->invlet) - 'a'] = ' '; alphabet[let - 'a'] = ' ';
} else if (let >= 'A' && let <= 'Z')
alphabet[let - 'A' + 26] = ' ';
}
/* compact the list by removing all the blanks */ /* compact the list by removing all the blanks */
for (ix = cur = 0; alphabet[ix]; ix++) for (ix = cur = 0; alphabet[ix]; ix++)