From 0b7c7b425afbfcec0dcf1a2d178ab3c9874d5e7c Mon Sep 17 00:00:00 2001 From: Andrei Karas Date: Tue, 2 Nov 2010 23:06:10 +0000 Subject: Fix some crashes in cart system. Also limit using carts only to cartoon players. --- src/map/pc.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/map/pc.c b/src/map/pc.c index 2b5dc3e..11cd864 100644 --- a/src/map/pc.c +++ b/src/map/pc.c @@ -3808,8 +3808,14 @@ int pc_putitemtocart (struct map_session_data *sd, int idx, int amount) struct item *item_data; nullpo_retr (0, sd); + + if (idx < 0 || idx >= MAX_INVENTORY) + return 1; + nullpo_retr (0, item_data = &sd->status.inventory[idx]); + if (!pc_iscarton (sd)) + return 1; if (item_data->nameid == 0 || item_data->amount < amount) return 1; if (pc_cart_additem (sd, item_data, amount) == 0) @@ -3827,8 +3833,14 @@ int pc_cartitem_amount (struct map_session_data *sd, int idx, int amount) struct item *item_data; nullpo_retr (-1, sd); + + if (idx < 0 || idx >= MAX_CART) + return -1; + nullpo_retr (-1, item_data = &sd->status.cart[idx]); + if (!pc_iscarton (sd)) + return -1; if (item_data->nameid == 0 || !item_data->amount) return -1; return item_data->amount - amount; @@ -3845,8 +3857,14 @@ int pc_getitemfromcart (struct map_session_data *sd, int idx, int amount) int flag; nullpo_retr (0, sd); + + if (idx < 0 || idx >= MAX_CART) + return 1; + nullpo_retr (0, item_data = &sd->status.cart[idx]); + if (!pc_iscarton (sd)) + return 1; if (item_data->nameid == 0 || item_data->amount < amount) return 1; if ((flag = pc_additem (sd, item_data, amount)) == 0) -- cgit v1.2.3-60-g2f50