diff --git a/doc/fixes36.5 b/doc/fixes36.5 index 9085747ab..b024d3320 100644 --- a/doc/fixes36.5 +++ b/doc/fixes36.5 @@ -7,6 +7,8 @@ produce 3.6.5 as well as any post-release fixes in binaries. General Fixes and Modified Features ----------------------------------- have string_for_opt() return empty_optstr on failure +fix accessing mons[-1] when trying to gate in a non-valid demon +fix accessing mons[-1] when monster figures out if a tin cures stoning ensure existing callers of string_for_opt() check return value before using it fix potential buffer overflow in add_menu_coloring() fix potential buffer overflow in sym_val() diff --git a/src/minion.c b/src/minion.c index fa37a5480..4277b4587 100644 --- a/src/minion.c +++ b/src/minion.c @@ -78,11 +78,13 @@ struct monst *mon; if (is_dprince(ptr) || (ptr == &mons[PM_WIZARD_OF_YENDOR])) { dtype = (!rn2(20)) ? dprince(atyp) : (!rn2(4)) ? dlord(atyp) : ndemon(atyp); - cnt = (!rn2(4) && is_ndemon(&mons[dtype])) ? 2 : 1; + cnt = ((dtype != NON_PM) + && !rn2(4) && is_ndemon(&mons[dtype])) ? 2 : 1; } else if (is_dlord(ptr)) { dtype = (!rn2(50)) ? dprince(atyp) : (!rn2(20)) ? dlord(atyp) : ndemon(atyp); - cnt = (!rn2(4) && is_ndemon(&mons[dtype])) ? 2 : 1; + cnt = ((dtype != NON_PM) + && !rn2(4) && is_ndemon(&mons[dtype])) ? 2 : 1; } else if (is_ndemon(ptr)) { dtype = (!rn2(20)) ? dlord(atyp) : (!rn2(6)) ? ndemon(atyp) : monsndx(ptr); @@ -91,7 +93,8 @@ struct monst *mon; dtype = (is_lord(ptr) && !rn2(20)) ? llord() : (is_lord(ptr) || !rn2(6)) ? lminion() : monsndx(ptr); - cnt = (!rn2(4) && !is_lord(&mons[dtype])) ? 2 : 1; + cnt = ((dtype != NON_PM) + && !rn2(4) && !is_lord(&mons[dtype])) ? 2 : 1; } else if (ptr == &mons[PM_ANGEL]) { /* non-lawful angels can also summon */ if (!rn2(6)) { @@ -107,7 +110,8 @@ struct monst *mon; } else { dtype = PM_ANGEL; } - cnt = (!rn2(4) && !is_lord(&mons[dtype])) ? 2 : 1; + cnt = ((dtype != NON_PM) + && !rn2(4) && !is_lord(&mons[dtype])) ? 2 : 1; } if (dtype == NON_PM) diff --git a/src/muse.c b/src/muse.c index 772a01777..2dfb92f3f 100644 --- a/src/muse.c +++ b/src/muse.c @@ -2325,6 +2325,8 @@ boolean tinok; if (obj->otyp != CORPSE && (obj->otyp != TIN || !tinok)) return FALSE; /* corpse, or tin that mon can open */ + if (obj->corpsenm == NON_PM) /* empty/special tin */ + return FALSE; return (boolean) (obj->corpsenm == PM_LIZARD || (acidic(&mons[obj->corpsenm]) && (obj->corpsenm != PM_GREEN_SLIME