nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

random_response() buffer overflow

Browse Source 
'sz' is the size of the buffer; 'if (count < sz) buf[count++] = c;'
can fill the entire buffer, leaving count==sz, so buf[count] = '\0';
would be out of bounds.

Formatting was way off.  Indentation these days should be multiples
of 4 spaces, never tabs.
This commit is contained in:
PatR
2018-12-13 02:12:31 -08:00
parent f9beca06dc
commit cf7536b167
2 changed files with 23 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cmd.c
+15 -17
View File
@@ -1,4 +1,4 @@
/* NetHack 3.6 cmd.c $NHDT-Date: 1544669664 2018/12/13 02:54:24 $ $NHDT-Branch: NetHack-3.6.2-beta01 $:$NHDT-Revision: 1.315 $ */ /* NetHack 3.6 cmd.c $NHDT-Date: 1544695944 2018/12/13 10:12:24 $ $NHDT-Branch: NetHack-3.6.2-beta01 $:$NHDT-Revision: 1.318 $ */
/* Copyright (c) Stichting Mathematisch Centrum, Amsterdam, 1985. */ /* Copyright (c) Stichting Mathematisch Centrum, Amsterdam, 1985. */
/*-Copyright (c) Robert Patrick Rankin, 2013. */ /*-Copyright (c) Robert Patrick Rankin, 2013. */
/* NetHack may be freely redistributed. See license for details. */ /* NetHack may be freely redistributed. See license for details. */
@@ -4442,23 +4442,21 @@ random_response(buf, sz)
char *buf; char *buf;
int sz; int sz;
{ {
int count = 0; char c;
while (1) { int count = 0;
char c = randomkey();
if (c == '\n') for (;;) {
break; c = randomkey();
if (c == '\n')
if (c == '\033') { break;
count = 0; if (c == '\033') {
break; count = 0;
} break;
}
if (count < sz) if (count < sz - 1)
buf[count++] = c; buf[count++] = c;
} }
buf[count] = '\0';
buf[count] = '\0';
} }
int int
win/win32/mhdlg.c
+8 -8
View File
@@ -1,4 +1,4 @@
/* NetHack 3.6 mhdlg.c $NHDT-Date: 1432512812 2015/05/25 00:13:32 $ $NHDT-Branch: master $:$NHDT-Revision: 1.25 $ */ /* NetHack 3.6 mhdlg.c $NHDT-Date: 1544695946 2018/12/13 10:12:26 $ $NHDT-Branch: NetHack-3.6.2-beta01 $:$NHDT-Revision: 1.30 $ */
/* Copyright (C) 2001 by Alex Kompel */ /* Copyright (C) 2001 by Alex Kompel */
/* NetHack may be freely redistributed. See license for details. */ /* NetHack may be freely redistributed. See license for details. */
@@ -25,13 +25,13 @@ INT_PTR CALLBACK GetlinDlgProc(HWND, UINT, WPARAM, LPARAM);
int int
mswin_getlin_window(const char *question, char *result, size_t result_size) mswin_getlin_window(const char *question, char *result, size_t result_size)
{ {
if (iflags.debug_fuzzer) { if (iflags.debug_fuzzer) {
random_response(result, result_size); random_response(result, (int) result_size);
if (result[0] != '\0') if (result[0] != '\0')
return IDOK; return IDOK;
else else
return IDCANCEL; return IDCANCEL;
} }
INT_PTR ret; INT_PTR ret;
struct getlin_data data; struct getlin_data data;