Add extra checks into mail system.

2 files changed, 14 insertions, 4 deletions

diff --git a/src/map/clif.c b/src/map/clif.c
index ac1052c71..9c172a2ee 100644
--- a/src/map/clif.c
+++ b/src/map/clif.c
@@ -14576,8 +14576,9 @@ void clif_parse_Mail_getattach(int fd, struct map_session_data *sd)
 
 	sd->mail.inbox.msg[i].zeny = 0;
 	memset(&sd->mail.inbox.msg[i].item, 0, sizeof(struct item));
-	clif->mail_read(sd, mail_id);
+	mail->clear(sd);
 
+	clif->mail_read(sd, mail_id);
 	intif->Mail_getattach(sd->status.char_id, mail_id);
 }
 
@@ -14605,6 +14606,9 @@ void clif_parse_Mail_delete(int fd, struct map_session_data *sd)
 			return;
 		}
 
+		sd->mail.inbox.msg[i].zeny = 0;
+		memset(&sd->mail.inbox.msg[i].item, 0, sizeof(struct item));
+		mail->clear(sd);
 		intif->Mail_delete(sd->status.char_id, mail_id);
 	}
 }
@@ -14623,10 +14627,14 @@ void clif_parse_Mail_return(int fd, struct map_session_data *sd)
 		return;
 
 	ARR_FIND(0, MAIL_MAX_INBOX, i, sd->mail.inbox.msg[i].id == mail_id);
-	if( i < MAIL_MAX_INBOX && sd->mail.inbox.msg[i].send_id != 0 )
+	if (i < MAIL_MAX_INBOX && sd->mail.inbox.msg[i].send_id != 0) {
+		sd->mail.inbox.msg[i].zeny = 0;
+		memset(&sd->mail.inbox.msg[i].item, 0, sizeof(struct item));
+		mail->clear(sd);
 		intif->Mail_return(sd->status.char_id, mail_id);
-	else
+	} else {
 		clif->mail_return(sd->fd, mail_id, 1);
+	}
 }
 
 
diff --git a/src/map/mail.c b/src/map/mail.c
index 0bdad2877..8acfbdcb9 100644
--- a/src/map/mail.c
+++ b/src/map/mail.c
@@ -83,7 +83,7 @@ unsigned char mail_setitem(struct map_session_data *sd, int idx, int amount) {
 
 		if( idx < 0 || idx >= MAX_INVENTORY )
 			return 1;
-		if( amount < 0 || amount > sd->status.inventory[idx].amount )
+		if( amount <= 0 || amount > sd->status.inventory[idx].amount )
 			return 1;
 		if( !pc_can_give_items(sd) || sd->status.inventory[idx].expire_time ||
 			!itemdb_canmail(&sd->status.inventory[idx],pc_get_group_level(sd)) ||
@@ -122,6 +122,8 @@ bool mail_setattachment(struct map_session_data *sd, struct mail_message *msg)
 
 		memcpy(&msg->item, &sd->status.inventory[n], sizeof(struct item));
 		msg->item.amount = sd->mail.amount;
+		if (msg->item.amount != sd->mail.amount)  // check for amount overflow
+			return false;
 	}
 	else
 		memset(&msg->item, 0x00, sizeof(struct item));