From: PatR <rankin@nethack.org>
Date: Sun, 1 Mar 2020 22:36:28 +0000 (-0800)
Subject: fix github issue #309 - random role segfault
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ffcd471ef7e9737032fa7fe85f67cbfdbaca2175;p=nethack

fix github issue #309 - random role segfault

Role selection is insanely complex.  I had to use a debugger to force
the relevant routine to be executed.

The analysis was correct:  it could use rn2(14) to pick a role (valid
values 0 through 12) and randomly getting 13 would lead to a crash.

The terminating element of roles[] passes all the ok_role(), ok_race(),
etc tests.  Explicitly exclude that element when collecting the roles
to choose from.
---

diff --git a/doc/fixes37.0 b/doc/fixes37.0
index b2155813b..1c65f3f3d 100644
--- a/doc/fixes37.0
+++ b/doc/fixes37.0
@@ -1,4 +1,4 @@
-$NHDT-Branch: NetHack-3.7 $:$NHDT-Revision: 1.114 $ $NHDT-Date: 1583073988 2020/03/01 14:46:28 $
+$NHDT-Branch: NetHack-3.7 $:$NHDT-Revision: 1.115 $ $NHDT-Date: 1583102142 2020/03/01 22:35:42 $
 
 General Fixes and Modified Features
 -----------------------------------
@@ -60,6 +60,7 @@ prevent ravens from blinding other ravens: /corvus oculum corvi non eruit/
 have ^X provide more information when held or swallowed
 avoid divide by 0 crash if 'bogusmon' (file of bogus monster types) is empty
 display wasn't updating immediately after toggling hilite_pet option
+randomly choosing role could lead to crash via segfault
 
 
 Fixes to 3.7.0-x Problems that Were Exposed Via git Repository
diff --git a/src/role.c b/src/role.c
index f93859da1..39d964d3a 100644
--- a/src/role.c
+++ b/src/role.c
@@ -1,4 +1,4 @@
-/* NetHack 3.6	role.c	$NHDT-Date: 1578947634 2020/01/13 20:33:54 $  $NHDT-Branch: NetHack-3.7 $:$NHDT-Revision: 1.68 $ */
+/* NetHack 3.6	role.c	$NHDT-Date: 1583102142 2020/03/01 22:35:42 $  $NHDT-Branch: NetHack-3.7 $:$NHDT-Revision: 1.69 $ */
 /* Copyright (c) Stichting Mathematisch Centrum, Amsterdam, 1985-1999. */
 /*-Copyright (c) Robert Patrick Rankin, 2012. */
 /* NetHack may be freely redistributed.  See license for details. */
@@ -749,7 +749,7 @@ randrole_filtered()
 
     /* this doesn't rule out impossible combinations but attempts to
        honor all the filter masks */
-    for (i = 0; i < SIZE(roles); ++i)
+    for (i = 0; i < SIZE(roles) - 1; ++i) /* -1: avoid terminating element */
         if (ok_role(i, ROLE_NONE, ROLE_NONE, ROLE_NONE)
             && ok_race(i, ROLE_RANDOM, ROLE_NONE, ROLE_NONE)
             && ok_gend(i, ROLE_NONE, ROLE_RANDOM, ROLE_NONE)
@@ -1939,7 +1939,7 @@ boolean preselect;
  *      1 - The Rogue Leader is the Tourist Nemesis.
  *      2 - Priests start with a random alignment - convert the leader and
  *          guardians here.
- *      3 - Priests also get their of deities from a randomly chosen role.
+ *      3 - Priests also get their set of deities from a randomly chosen role.
  *      4 - [obsolete] Elves can have one of two different leaders,
  *          but can't work it out here because it requires hacking the
  *          level file data (see sp_lev.c).