|
From: <dsh...@us...> - 2007-04-01 22:13:24
|
Revision: 1180
http://svn.sourceforge.net/crawl-ref/?rev=1180&view=rev
Author: dshaligram
Date: 2007-04-01 15:13:21 -0700 (Sun, 01 Apr 2007)
Log Message:
-----------
Fixed potential buffer overflow on long inscriptions.
Modified Paths:
--------------
trunk/crawl-ref/source/tags.cc
Modified: trunk/crawl-ref/source/tags.cc
===================================================================
--- trunk/crawl-ref/source/tags.cc 2007-04-01 21:25:42 UTC (rev 1179)
+++ trunk/crawl-ref/source/tags.cc 2007-04-01 22:13:21 UTC (rev 1180)
@@ -314,7 +314,6 @@
// put in the actual string -- we'll null terminate on
// unmarshall.
memcpy(&tagBuffer[th.offset], data, len);
-
th.offset += len;
}
@@ -324,6 +323,7 @@
// get length
short len = unmarshallShort(th);
int copylen = len;
+
if (len >= maxSize && maxSize > 0)
copylen = maxSize - 1;
@@ -1137,8 +1137,7 @@
you.num_turns = unmarshallLong(th);
you.magic_contamination = unmarshallShort(th);
- unmarshallString( th, buff, 80 );
- you.last_altar_inscription = buff;
+ you.last_altar_inscription = unmarshallString(th, 80);
}
static void tag_read_you_items(struct tagHeader &th, char minorVersion)
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|