]> granicus.if.org Git - nethack/commit
random_response() buffer overflow
authorPatR <rankin@nethack.org>
Thu, 13 Dec 2018 10:12:31 +0000 (02:12 -0800)
committerPatR <rankin@nethack.org>
Thu, 13 Dec 2018 10:12:31 +0000 (02:12 -0800)
commitcf7536b1675f0b6074775c4ca984ffdde76c058c
tree52a44cd4b0aa413551c39884a2fed67cbf36a5a4
parentf9beca06dcbe6c3088a4182883dce0342c02f436
random_response() buffer overflow

'sz' is the size of the buffer; 'if (count < sz) buf[count++] = c;'
can fill the entire buffer, leaving count==sz, so buf[count] = '\0';
would be out of bounds.

Formatting was way off.  Indentation these days should be multiples
of 4 spaces, never tabs.
src/cmd.c
win/win32/mhdlg.c