diff options
| author | ai4rei <ai4rei@54d463be-8e91-2dee-dedb-b68131a5f0ec> | 2011-02-14 12:49:08 +0000 |
|---|---|---|
| committer | ai4rei <ai4rei@54d463be-8e91-2dee-dedb-b68131a5f0ec> | 2011-02-14 12:49:08 +0000 |
| commit | 66a2591b0efac372690b707ed1020a376f260ded (patch) | |
| tree | be730d633c409a33b26d37974ef84c520fa80c8a /src/map/script.c | |
| parent | 71bce4923da7217a0836e151e23248e836444600 (diff) | |
| download | hercules-66a2591b0efac372690b707ed1020a376f260ded.tar.gz hercules-66a2591b0efac372690b707ed1020a376f260ded.tar.bz2 hercules-66a2591b0efac372690b707ed1020a376f260ded.tar.xz hercules-66a2591b0efac372690b707ed1020a376f260ded.zip | |
* Fixed a crash when script 'npctalk' is given too long string (bugreport:4759, related r2145).
- Fixed related buffer overflows in message related clif functions (since r1182, r14270).
git-svn-id: https://rathena.svn.sourceforge.net/svnroot/rathena/trunk@14704 54d463be-8e91-2dee-dedb-b68131a5f0ec
Diffstat (limited to 'src/map/script.c')
| -rw-r--r-- | src/map/script.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/src/map/script.c b/src/map/script.c index df862dcc0..bbb0041de 100644 --- a/src/map/script.c +++ b/src/map/script.c @@ -11813,17 +11813,17 @@ BUILDIN_FUNC(message) BUILDIN_FUNC(npctalk) { const char* str; - char message[255]; + char name[NAME_LENGTH], message[256]; struct npc_data* nd = (struct npc_data *)map_id2bl(st->oid); str = script_getstr(st,2); - if(nd) { - memcpy(message, nd->name, NAME_LENGTH); - strtok(message, "#"); // discard extra name identifier if present - strcat(message, " : "); - strncat(message, str, 254); //Prevent overflow possibility. [Skotlex] - clif_message(&(nd->bl), message); + if(nd) + { + safestrncpy(name, nd->name, sizeof(name)); + strtok(name, "#"); // discard extra name identifier if present + safesnprintf(message, sizeof(message), "%s : %s", name, str); + clif_message(&nd->bl, message); } return 0; |