3 files changed, 22 insertions, 17 deletions
diff --git a/src/map/clif.c b/src/map/clif.c
index 62273c0..c27bddf 100644
--- a/src/map/clif.c
+++ b/src/map/clif.c
@@ -7165,15 +7165,10 @@ void clif_parse_GlobalMessage (int fd, struct map_session_data *sd)
 int clif_message (struct block_list *bl, char *msg)
 {
     unsigned short msg_len = strlen (msg) + 1;
-    static int buf_len = -1;
-    static unsigned char *buf = NULL;
+    unsigned char buf[512];
 
-    if (buf_len < msg_len)
-    {
-        if (buf)
-            free (buf);
-        buf = malloc (buf_len = (msg_len + 16));
-    }
+    if (msg_len + 16 > 512)
+        return 0;
 
     nullpo_retr (0, bl);
 
diff --git a/src/map/npc.c b/src/map/npc.c
index d302fe8..d3def90 100644
--- a/src/map/npc.c
+++ b/src/map/npc.c
@@ -138,16 +138,22 @@ int npc_event_dequeue (struct map_session_data *sd)
     nullpo_retr (0, sd);
 
     sd->npc_id = 0;
+
     if (sd->eventqueue[0][0])
-    {                           // �L���[�̃C�x���g����
-        char *name = (char *) aCalloc (50, sizeof (char));
-        int  i;
+    {
+        if (!pc_addeventtimer(sd, 100, sd->eventqueue[0]))
+        {
+            printf ("npc_event_dequeue(): Event timer is full.\n");
+            return 0;
+        }
 
-        memcpy (name, sd->eventqueue[0], 50);
-        for (i = MAX_EVENTQUEUE - 2; i >= 0; i--)
-            memcpy (sd->eventqueue[i], sd->eventqueue[i + 1], 50);
-        add_timer (gettick () + 100, npc_event_timer, sd->bl.id, (int) name);
+        if (MAX_EVENTQUEUE > 1)
+            memmove (sd->eventqueue[0], sd->eventqueue[1],
+                     (MAX_EVENTQUEUE - 1) * sizeof (sd->eventqueue[0]));
+        sd->eventqueue[MAX_EVENTQUEUE - 1][0] = '\0';
+        return 1;
     }
+
     return 0;
 }
 
@@ -747,7 +753,8 @@ int npc_event (struct map_session_data *sd, const char *eventname,
         {
 //          if (battle_config.etc_log)
 //              printf("npc_event: enqueue\n");
-            memcpy (sd->eventqueue[i], eventname, 50);
+            strncpy (sd->eventqueue[i], eventname, 50);
+            sd->eventqueue[i][49] = '\0';
         }
         return 1;
     }
diff --git a/src/map/pc.c b/src/map/pc.c
index bf819a1..13aa702 100644
--- a/src/map/pc.c
+++ b/src/map/pc.c
@@ -7209,13 +7209,16 @@ int pc_addeventtimer (struct map_session_data *sd, int tick, const char *name)
     for (i = 0; i < MAX_EVENTTIMER; i++)
         if (sd->eventtimer[i] == -1)
             break;
+
     if (i < MAX_EVENTTIMER)
     {
         char *evname = (char *) aCalloc (24, sizeof (char));
-        memcpy (evname, name, 24);
+        strncpy (evname, name, 24);
+        evname[23] = '\0';
         sd->eventtimer[i] = add_timer (gettick () + tick,
                                        pc_eventtimer, sd->bl.id,
                                        (int) evname);
+        return 1;
     }
 
     return 0;