nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

fix out of bounds error in tty_status_update() for BL_HUNGER case

Browse Source 
The pointer could go out of bounds when decremented if it was pointing
at the start of the status_vals[BL_HUNGER] (empty string).

Also, guard tty_status_update() from an out of range index being
passed to it (botl shouldn't do that, but...).

The legal 1st parameter values for tty_status_update() in 3.6.2 are

	BL_RESET     (-2)
	BL_FLUSH     (-1)
	BL_TITLE     ( 0)
	...though to...
	BL_CONDITION (22)

  count MAXBLSTATS = (BL_CONDITION + 1)

There's a BL_CHARACTERISTIC (-3) defined in the botl.h header file,
but it is not used in wintty.c and is now screened out along with
everything lower and everything MAXBLSTATS and above.

closes #142
fixes #141
This commit is contained in:
nhmall
2018-09-26 17:18:09 -04:00
parent 74b7829957
commit c5d0f6dd9d
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/fixes36.2
+1
View File
@@ -167,6 +167,7 @@ tty: turn off an optimization that is the suspected cause of Windows reported
partial status lines following level changes partial status lines following level changes
tty: ensure that current status fields are always copied to prior status tty: ensure that current status fields are always copied to prior status
values so that comparisons are correct values so that comparisons are correct
tty: fix an out of bounds error in tty_status_update() for BL_HUNGER case
X11: its use of genl_status_update exposed a negative index use that could X11: its use of genl_status_update exposed a negative index use that could
lead to a segfault lead to a segfault
win/tty/wintty.c
+10 -5
View File
@@ -3666,6 +3666,9 @@ unsigned long *colormasks;
char *fval = (char *) 0; char *fval = (char *) 0;
boolean reset_state = NO_RESET; boolean reset_state = NO_RESET;
if ((fldidx < BL_RESET) || (fldidx >= MAXBLSTATS))
return;
if ((fldidx >= 0 && fldidx < MAXBLSTATS) && !status_activefields[fldidx]) if ((fldidx >= 0 && fldidx < MAXBLSTATS) && !status_activefields[fldidx])
return; return;
@@ -3727,11 +3730,13 @@ unsigned long *colormasks;
case BL_HUNGER: case BL_HUNGER:
/* The core sends trailing blanks for some fields. /* The core sends trailing blanks for some fields.
Let's suppress the trailing blanks */ Let's suppress the trailing blanks */
lastchar = eos(status_vals[fldidx]); if (tty_status[NOW][fldidx].lth > 0) {
lastchar--; lastchar = eos(status_vals[fldidx]);
while (*lastchar == ' ' && lastchar >= status_vals[fldidx]) { lastchar--;
*lastchar-- = '\0'; while (lastchar >= status_vals[fldidx] && *lastchar == ' ') {
tty_status[NOW][fldidx].lth--; *lastchar-- = '\0';
tty_status[NOW][fldidx].lth--;
}
} }
break; break;
case BL_TITLE: case BL_TITLE: