UnNetHack SVN版rev.732を適用した。
Fix buffer overflow crash when taking off a max length named item with the traditional menustyle
menustyleがtraditionalの場合に名前が最大長のアイテムを選択するとバッファオーバーフローでクラッシュするのを修正
junnethack/trunk/ChangeLog.jun (diff)
junnethack/trunk/src/invent.c (diff)| @@ -1707,8 +1707,22 @@ | ||
| 1707 | 1707 | if (ident && !not_fully_identified(otmp)) continue; |
| 1708 | 1708 | if (ckfn && !(*ckfn)(otmp)) continue; |
| 1709 | 1709 | if (!allflag) { |
| 1710 | - Strcpy(qbuf, !ininv ? doname(otmp) : | |
| 1711 | - xprname(otmp, (char *)0, ilet, !nodot, 0L, 0L)); | |
| 1710 | + char name[BUFSZ]; | |
| 1711 | + char simple_name[BUFSZ]; | |
| 1712 | + char this_item[BUFSZ]; | |
| 1713 | + /* make sure a overly long named item doesn't buffer overflow | |
| 1714 | + * qbuf when using the traditional menu style */ | |
| 1715 | +#if 0 /*JP*/ | |
| 1716 | + Strcpy(qbuf, safe_qbuf("", sizeof("?"), | |
| 1717 | + !ininv ? doname(otmp) : name, | |
| 1718 | + !ininv ? the(simple_typename(otmp->otyp)) : simple_name, | |
| 1719 | + !ininv ? "this item" : this_item)); | |
| 1720 | +#else | |
| 1721 | + Strcpy(qbuf, safe_qbuf("", sizeof("？"), | |
| 1722 | + !ininv ? doname(otmp) : name, | |
| 1723 | + !ininv ? simple_typename(otmp->otyp) : simple_name, | |
| 1724 | + !ininv ? "このアイテム" : this_item)); | |
| 1725 | +#endif | |
| 1712 | 1726 | /*JP |
| 1713 | 1727 | Strcat(qbuf, "?"); |
| 1714 | 1728 | */ |