fix prompt string overflow in lift_object()

<email deleted> wrote:
> The game crashed badly when I made some experiments with items
> with very long names:
>
> You have much trouble lifting a blessed greased thoroughly rusty  >thoroughly corroded +3 plate mail named terribly long killer longer than my
>ong long-worm called long.  Continue? [ynq] (q)

  tty_yn_function(const char * 0x0012fa50,
      const char * 0x00572ddc _ynqchars, char 113) line 379 + 6 bytes
  lift_object(obj * 0x009e8970, obj * 0x00000000,
      long * 0x0012fcd0, char 0) line 1131 + 20 bytes
  pickup_object(obj * 0x009e8970, long 1, char 0) line 1258 + 19 bytes
  pickup(int 0) line 474 + 28 bytes
  dopickup() line 1853 + 11 bytes
  rhack(char * 0x005c0d50 in_line) line 1908 + 3 bytes
  moveloop() line 406 + 7 bytes
  main(int 3, char * * 0x009e2ac0) line 102

diff --git a/doc/fixes34.2 b/doc/fixes34.2
index 996900f0722c0358b275f217c6a2146ec2d813fb..4a58fce8b7705ab912d592f7e48690b17c9600e2 100644 (file)
--- a/doc/fixes34.2
+++ b/doc/fixes34.2
@@ -50,6 +50,7 @@ give more explicit feedback for exploding bag of holding
 help display for "list of game options" misformats runmode and scroll_amount
 pit created by land mine explosion doesn't start out concealed
 update map display sooner when pushed boulder triggers land mine explosion
+prevent fatal error from prompt string overflow in lift_object() 
 
 
 Platform- and/or Interface-Specific Fixes

diff --git a/doc/fixes35.0 b/doc/fixes35.0
index 3994c90625d7c148f9aede6b2cfd0a17eae20c4c..f508fce4f07944e3b2d0f7cb291857be8a824b88 100644 (file)
--- a/doc/fixes35.0
+++ b/doc/fixes35.0
@@ -26,6 +26,7 @@ dust vortex-induced blindness should kick in immediately when blindfold
        is removed or glop is wiped off
 prayer/unicorn-horn won't fix blindness while still engulfed in a dust
        vortex since it will just return immediately
+prevent fatal error from prompt string overflow in lift_object() 
 
 
 Platform- and/or Interface-Specific Fixes

diff --git a/src/pickup.c b/src/pickup.c
index 90262c3f52a41b63eae5f157ef5d212abce3e000..ba54adc2a59bf0fce0ca1484d56291c88974727f 100644 (file)
--- a/src/pickup.c
+++ b/src/pickup.c
@@ -1122,12 +1122,18 @@ boolean telekinesis;
            } else {
                char qbuf[BUFSZ];
                long savequan = obj->quan;
+               unsigned textleft;
 
                obj->quan = *cnt_p;
-               Sprintf(qbuf, "%s %s.  Continue?",
+               Strcpy(qbuf,
                        (next_encumbr > HVY_ENCUMBER) ? overloadmsg :
                        (next_encumbr > MOD_ENCUMBER) ? nearloadmsg :
-                       moderateloadmsg, doname(obj));
+                       moderateloadmsg);
+               textleft = QBUFSZ - (strlen(qbuf) + sizeof(" . Continue?"));
+               Sprintf(eos(qbuf), " %s. Continue?",
+                       (strlen(doname(obj)) < textleft) ? doname(obj) :
+                       (strlen(simple_typename(obj->otyp)) < textleft) ?
+                       an(simple_typename(obj->otyp)) : something);
                obj->quan = savequan;
                switch (ynq(qbuf)) {
                case 'q':  result = -1; break;