Fixed a bug in the npc shop code, where requesting an item that wasn't on the list caused the server to keep scanning past the list's array bounds.

git-svn-id: https://rathena.svn.sourceforge.net/svnroot/rathena/trunk@12980 54d463be-8e91-2dee-dedb-b68131a5f0ec

1 files changed, 18 insertions, 16 deletions

diff --git a/src/map/clif.c b/src/map/clif.c
index bf9655aff..103994a76 100644
--- a/src/map/clif.c
+++ b/src/map/clif.c
@@ -8869,27 +8869,29 @@ void clif_parse_NpcBuySellSelected(int fd,struct map_session_data *sd)
 	npc_buysellsel(sd,RFIFOL(fd,2),RFIFOB(fd,6));
 }
 
-/*==========================================
- *
- *------------------------------------------*/
-void clif_parse_NpcBuyListSend(int fd,struct map_session_data *sd)
-{
-	int fail=0,n;
-	unsigned short *item_list;
-
-	n = (RFIFOW(fd,2)-4) /4;
-	item_list = (unsigned short*)RFIFOP(fd,4);
-
-	if (sd->state.trading|| !sd->npc_shopid)
-		fail = 1;
+/// Request to buy chosen items from npc shop
+/// S 00c8 <length>.w {<amount>.w <itemid>.w).4b*
+/// R 00ca <result>.b
+/// result = 00 -> "The deal has successfully completed." 
+/// result = 01 -> "You do not have enough zeny."
+/// result = 02 -> "You are over your Weight Limit."
+/// result = 03 -> "Out of the maximum capacity, you have too many items."
+void clif_parse_NpcBuyListSend(int fd, struct map_session_data* sd)
+{
+	int n = (RFIFOW(fd,2)-4) /4;
+	unsigned short* item_list = (unsigned short*)RFIFOP(fd,4);
+	int result;
+
+	if( sd->state.trading || !sd->npc_shopid )
+		result = 1;
 	else
-		fail = npc_buylist(sd,n,item_list);
+		result = npc_buylist(sd,n,item_list);
 
 	sd->npc_shopid = 0; //Clear shop data.
 
 	WFIFOHEAD(fd,packet_len(0xca));
-	WFIFOW(fd,0)=0xca;
-	WFIFOB(fd,2)=fail;
+	WFIFOW(fd,0) = 0xca;
+	WFIFOB(fd,2) = result;
 	WFIFOSET(fd,packet_len(0xca));
 }