Fix possible lev_comp segfault when map was too tall

diff --git a/doc/fixes36.1 b/doc/fixes36.1
index 9df0bdc0a7cb1d002b1a19d8e6e54af7408cafb8..97fc2b3607f08fd5af0072f15fb385a9d9cb811b 100644 (file)
--- a/doc/fixes36.1
+++ b/doc/fixes36.1
@@ -102,6 +102,7 @@ make vault guard accept names starting with number
 fix weight of containers in special levels
 allow knife and stiletto as possible tin opening tools
 make the raven medusa level shortsighted
+fix possible segfault in lev_comp when map was too tall
 
 
 Platform- and/or Interface-Specific Fixes

diff --git a/util/lev_main.c b/util/lev_main.c
index d3350e17822822cf5089c614fabb6f6845ee945e..c95441bce2e0eb0f946d844741e16e8384422b85 100644 (file)
--- a/util/lev_main.c
+++ b/util/lev_main.c
@@ -1351,7 +1351,7 @@ sp_lev *sp;
     register char *s1, *s2;
     int max_len = 0;
     int max_hig = 0;
-    char *tmpmap[ROWNO];
+    char *tmpmap[MAP_Y_LIM+1];
     int dx, dy;
     char *mbuf;
 
@@ -1378,6 +1378,8 @@ sp_lev *sp;
 
     /* Then parse it now */
     while (map && *map) {
+        if (max_hig > MAP_Y_LIM)
+            break;
         tmpmap[max_hig] = (char *) alloc(max_len);
         s1 = index(map, '\n');
         if (s1) {