From: Pasi Kallinen <paxed@alt.org>
Date: Mon, 21 Dec 2015 16:18:28 +0000 (+0200)
Subject: Fix findtravelpath buffer overflow
X-Git-Tag: NetHack-3.6.1_RC01~1131
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4b876b1aec1522bccf301901d03fb239c77662f1;p=nethack

Fix findtravelpath buffer overflow

Test case: Bigroom, full of boulders, with a single
path from travel start to travel end. Boulders (and
doors) are added to the travelstep[xy] arrays multiple
times, and will overflow the arrays.

Original patch via Acehack by Alex Smith
---

diff --git a/src/hack.c b/src/hack.c
index a3886457c..2f45d10fd 100644
--- a/src/hack.c
+++ b/src/hack.c
@@ -919,6 +919,7 @@ boolean guess;
                 static int ordered[] = { 0, 2, 4, 6, 1, 3, 5, 7 };
                 /* no diagonal movement for grid bugs */
                 int dirmax = NODIAG(u.umonnum) ? 4 : 8;
+                boolean alreadyrepeated = FALSE;
 
                 for (dir = 0; dir < dirmax; ++dir) {
                     int nx = x + xdir[ordered[dir]];
@@ -932,10 +933,13 @@ boolean guess;
                         /* closed doors and boulders usually
                          * cause a delay, so prefer another path */
                         if (travel[x][y] > radius - 3) {
-                            travelstepx[1 - set][nn] = x;
-                            travelstepy[1 - set][nn] = y;
-                            /* don't change travel matrix! */
-                            nn++;
+                            if (!alreadyrepeated) {
+                                travelstepx[1 - set][nn] = x;
+                                travelstepy[1 - set][nn] = y;
+                                /* don't change travel matrix! */
+                                nn++;
+                                alreadyrepeated = TRUE;
+                            }
                             continue;
                         }
                     }