nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

random_response() buffer overflow

Browse Source 
'sz' is the size of the buffer; 'if (count < sz) buf[count++] = c;'
can fill the entire buffer, leaving count==sz, so buf[count] = '\0';
would be out of bounds.

Formatting was way off.  Indentation these days should be multiples
of 4 spaces, never tabs.
This commit is contained in:
PatR
2018-12-13 02:12:31 -08:00
parent f9beca06dc
commit cf7536b167
2 changed files with 23 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
win/win32/mhdlg.c
View File

@@ -1,4 +1,4 @@
/* NetHack 3.6 mhdlg.c $NHDT-Date: 1432512812 2015/05/25 00:13:32 $ $NHDT-Branch: master $:$NHDT-Revision: 1.25 $ */
/* NetHack 3.6 mhdlg.c $NHDT-Date: 1544695946 2018/12/13 10:12:26 $ $NHDT-Branch: NetHack-3.6.2-beta01 $:$NHDT-Revision: 1.30 $ */
/* Copyright (C) 2001 by Alex Kompel */
/* NetHack may be freely redistributed. See license for details. */
@@ -25,13 +25,13 @@ INT_PTR CALLBACK GetlinDlgProc(HWND, UINT, WPARAM, LPARAM);
int
mswin_getlin_window(const char *question, char *result, size_t result_size)
{
if (iflags.debug_fuzzer) {
random_response(result, result_size);
if (result[0] != '\0')
return IDOK;
else
return IDCANCEL;
}
if (iflags.debug_fuzzer) {
random_response(result, (int) result_size);
if (result[0] != '\0')
return IDOK;
else
return IDCANCEL;
}
INT_PTR ret;
struct getlin_data data;