From: Pasi Kallinen <paxed@alt.org>
Date: Wed, 6 Jan 2016 17:48:46 +0000 (+0200)
Subject: Fix possible lev_comp segfault when map was too tall
X-Git-Tag: NetHack-3.6.1_RC01~1064^2~3
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=50359a35525bcaa534a07cf605ee761a40ff2fad;p=nethack

Fix possible lev_comp segfault when map was too tall
---

diff --git a/doc/fixes36.1 b/doc/fixes36.1
index 9df0bdc0a..97fc2b360 100644
--- a/doc/fixes36.1
+++ b/doc/fixes36.1
@@ -102,6 +102,7 @@ make vault guard accept names starting with number
 fix weight of containers in special levels
 allow knife and stiletto as possible tin opening tools
 make the raven medusa level shortsighted
+fix possible segfault in lev_comp when map was too tall
 
 
 Platform- and/or Interface-Specific Fixes
diff --git a/util/lev_main.c b/util/lev_main.c
index d3350e178..c95441bce 100644
--- a/util/lev_main.c
+++ b/util/lev_main.c
@@ -1351,7 +1351,7 @@ sp_lev *sp;
     register char *s1, *s2;
     int max_len = 0;
     int max_hig = 0;
-    char *tmpmap[ROWNO];
+    char *tmpmap[MAP_Y_LIM+1];
     int dx, dy;
     char *mbuf;
 
@@ -1378,6 +1378,8 @@ sp_lev *sp;
 
     /* Then parse it now */
     while (map && *map) {
+        if (max_hig > MAP_Y_LIM)
+            break;
         tmpmap[max_hig] = (char *) alloc(max_len);
         s1 = index(map, '\n');
         if (s1) {