aboutsummaryrefslogtreecommitdiff
path: root/undead.c
diff options
context:
space:
mode:
authorBen Harris <bjh21@bjh21.me.uk>2023-01-07 23:44:31 +0000
committerBen Harris <bjh21@bjh21.me.uk>2023-01-15 16:21:37 +0000
commit952ef8ca565d803da1134466358bd85683a489a3 (patch)
tree53fb598d0254d1bfab4edbb8d8ff4b8641b65213 /undead.c
parenta02c55b0492453ea7ca4e4ae63cb90ba4c93a3a5 (diff)
downloadpuzzles-952ef8ca565d803da1134466358bd85683a489a3.zip
puzzles-952ef8ca565d803da1134466358bd85683a489a3.tar.gz
puzzles-952ef8ca565d803da1134466358bd85683a489a3.tar.bz2
puzzles-952ef8ca565d803da1134466358bd85683a489a3.tar.xz
Undead: fix buffer overrun in "M" command
The guessable squares are numbered up to num_total, not "wh". The latter includes mirror squares that aren't included in the various arrays describing the game state. To reproduce the problem, build Undead with AddressSanitizer and press "M".
Diffstat (limited to 'undead.c')
-rw-r--r--undead.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/undead.c b/undead.c
index ef3827b..9c6b6fb 100644
--- a/undead.c
+++ b/undead.c
@@ -2103,7 +2103,7 @@ static game_state *execute_move(const game_state *state, const char *move)
* approach of starting off in that state and eliminating
* things.
*/
- for (i = 0; i < ret->common->wh; i++)
+ for (i = 0; i < ret->common->num_total; i++)
if (ret->guess[i] == 7)
ret->pencils[i] = 7;
move++;