From: PatR <rankin@nethack.org>
Date: Fri, 15 Apr 2022 17:07:19 +0000 (-0700)
Subject: fix github issue #734 - ^A crash
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ad460907329649b54893d663d24c6b3daa01191d;p=nethack

fix github issue #734 - ^A crash

Issue #734 reported as "parse function" by Meklon2007:  the change
yesterday intended to make ^A work for commands that were preceded
by a prefix was triggering a crash if used after a keystroke that's
not assigned to any command.

'M^A' or '~^A' would segfault by derefencing a null pointer when
checking whether 'M' or '~' was a prefix.  This prevents the check
attempt from doing that, but a better fix would be to not put the
invalid command keystroke into the do-again buffer in the first
place.

Fixes #734
---

diff --git a/doc/fixes3-7-0.txt b/doc/fixes3-7-0.txt
index 8ae631f61..82f04195b 100644
--- a/doc/fixes3-7-0.txt
+++ b/doc/fixes3-7-0.txt
@@ -1151,6 +1151,8 @@ arriving on Valkyrie quest final level could produce impossible warning
 	"mkstairs: placing stairs up on molten lava at <68,13>"
 if the repeat command was used after prefix+command, only the command part got
 	repeated
+the change for repeat after prefix+command would result in a crash if repeat
+	was attempted after an unassigned key
 
 curses: 'msg_window' option wasn't functional for curses unless the binary
 	also included tty support
diff --git a/src/cmd.c b/src/cmd.c
index 1750584c0..ab4ebe286 100644
--- a/src/cmd.c
+++ b/src/cmd.c
@@ -5163,11 +5163,12 @@ parse(void)
            re-enter with g.in_doagain set true */
         g.command_count = g.last_command_count;
     } else {
-        uchar c = (g.shead > 0) ? (uchar) g.saveq[g.shead - 1] & 0xff : 0;
+        uchar c = (g.shead > 0) ? (uchar) (g.saveq[g.shead - 1] & 0xff) : 0;
 
         g.last_command_count = g.command_count;
         /* reset saveq unless it holds a prefix */
-        if (!c || (g.Cmd.commands[c]->flags & PREFIXCMD) == 0)
+        if (!c || !g.Cmd.commands[c]
+            || (g.Cmd.commands[c]->flags & PREFIXCMD) == 0)
             savech(0);
         savech((char) foo);
     }