| version 1.88 | | version 1.89 |
|---|
| | |
| /* | | /* |
| * static char *rcsid_init_c = | | * static char *rcsid_init_c = |
| * "$Id: request.c,v 1.88 2006/05/05 09:41:15 ryo_saeba Exp $"; | | * "$Id: request.c,v 1.89 2006/05/13 21:21:12 akirschbaum Exp $"; |
| */ | | */ |
| | | |
| /* | | /* |
| | |
| } | | } |
| | | |
| /** | | /** |
| * This tells the client to add the spell *ob, if *ob is NULL, then add | | * This tells the client to add the spell *spell, if spell is NULL, then add |
| * all spells in the player's inventory. | | * all spells in the player's inventory. |
| */ | | */ |
| void esrv_add_spells(player *pl, object *spell) { | | void esrv_add_spells(player *pl, object *spell) { |
| | |
| sl.len=strlen((char*)sl.buf); | | sl.len=strlen((char*)sl.buf); |
| if (!spell) { | | if (!spell) { |
| for (spell=pl->ob->inv; spell!=NULL; spell=spell->below) { | | for (spell=pl->ob->inv; spell!=NULL; spell=spell->below) { |
| | | if (spell->type != SPELL) continue; |
| /* were we to simply keep appending data here, we could exceed | | /* were we to simply keep appending data here, we could exceed |
| * MAXSOCKBUF if the player has enough spells to add, we know that | | * MAXSOCKBUF if the player has enough spells to add, we know that |
| * append_spells will always append 19 data bytes, plus 4 length | | * append_spell will always append 23 data bytes, plus 3 length |
| * bytes and 3 strings (because that is the spec) so we need to | | * bytes and 2 strings (because that is the spec) so we need to |
| * check that the length of those 3 strings, plus the 23 bytes, | | * check that the length of those 2 strings, plus the 26 bytes, |
| * won't take us over the length limit for the socket, if it does, | | * won't take us over the length limit for the socket, if it does, |
| * we need to send what we already have, and restart packet formation | | * we need to send what we already have, and restart packet formation |
| */ | | */ |
| /* Seeing crashes by overflowed buffers. Quick arithemetic seems | | |
| * to show add_spell is 26 bytes + 2 strings. However, the overun | | |
| * is hundreds of bytes off, so correcting 22 vs 26 doesn't seem | | |
| * like it will fix this | | |
| */ | | |
| if (spell->type != SPELL) continue; | | |
| if (sl.len > (MAXSOCKBUF - (26 + strlen(spell->name) + | | if (sl.len > (MAXSOCKBUF - (26 + strlen(spell->name) + |
| (spell->msg?strlen(spell->msg):0)))) { | | (spell->msg?strlen(spell->msg):0)))) { |
| Send_With_Handling(&pl->socket, &sl); | | Send_With_Handling(&pl->socket, &sl); |