diff options
| author | Ben Harris <bjh21@bjh21.me.uk> | 2023-02-13 10:04:47 +0000 |
|---|---|---|
| committer | Ben Harris <bjh21@bjh21.me.uk> | 2023-02-13 10:49:31 +0000 |
| commit | 0a7c531e8f4c1970662f7c30aea006e65d5ff010 (patch) | |
| tree | 287619497ee1c0ac669b1a657a52f82b96776f74 /untangle.c | |
| parent | 493bf16ddbe2185664d6c3053f7891a9f232c75c (diff) | |
| download | puzzles-0a7c531e8f4c1970662f7c30aea006e65d5ff010.zip puzzles-0a7c531e8f4c1970662f7c30aea006e65d5ff010.tar.gz puzzles-0a7c531e8f4c1970662f7c30aea006e65d5ff010.tar.bz2 puzzles-0a7c531e8f4c1970662f7c30aea006e65d5ff010.tar.xz | |
Undead: check the return value of sscanf() in execute_move()
sscanf() assigns its output in order, so if a conversion specifier fails
to match, a later "%n" specifier will also not get its result assigned.
In Undead's execute_move(), this led to the result of "%n" being used
without being initialised. That could cause it to try to parse
arbitrary memory as part of the move string, which shouldn't be a
security problem (since execute_move() handles untrusted input anyway),
but could lead to a crash and certainly wasn't helpful.
Diffstat (limited to 'untangle.c')
0 files changed, 0 insertions, 0 deletions