aboutsummaryrefslogtreecommitdiff
path: root/untangle.c
diff options
context:
space:
mode:
authorBen Harris <bjh21@bjh21.me.uk>2023-02-13 10:04:47 +0000
committerBen Harris <bjh21@bjh21.me.uk>2023-02-13 10:49:31 +0000
commit0a7c531e8f4c1970662f7c30aea006e65d5ff010 (patch)
tree287619497ee1c0ac669b1a657a52f82b96776f74 /untangle.c
parent493bf16ddbe2185664d6c3053f7891a9f232c75c (diff)
downloadpuzzles-0a7c531e8f4c1970662f7c30aea006e65d5ff010.zip
puzzles-0a7c531e8f4c1970662f7c30aea006e65d5ff010.tar.gz
puzzles-0a7c531e8f4c1970662f7c30aea006e65d5ff010.tar.bz2
puzzles-0a7c531e8f4c1970662f7c30aea006e65d5ff010.tar.xz
Undead: check the return value of sscanf() in execute_move()
sscanf() assigns its output in order, so if a conversion specifier fails to match, a later "%n" specifier will also not get its result assigned. In Undead's execute_move(), this led to the result of "%n" being used without being initialised. That could cause it to try to parse arbitrary memory as part of the move string, which shouldn't be a security problem (since execute_move() handles untrusted input anyway), but could lead to a crash and certainly wasn't helpful.
Diffstat (limited to 'untangle.c')
0 files changed, 0 insertions, 0 deletions