From 8a06ff26fc6abd77a4b4a08b839943f588d92dcf Mon Sep 17 00:00:00 2001 From: Ben Harris Date: Sun, 8 Jan 2023 09:57:53 +0000 Subject: [PATCH] Filling: validate length of auto-solve move strings Without this, execute_move() can end up reading off the end of the move string, which isn't very friendly. Also remove the comment saying that the move string doesn't have to be null-terminated, because now it does. --- filling.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/filling.c b/filling.c index c07157e..92939a1 100644 --- a/filling.c +++ b/filling.c @@ -1110,8 +1110,6 @@ static bool solver(const int *orig, int w, int h, char **solution) { **solution = 's'; for (i = 0; i < sz; ++i) (*solution)[i + 1] = ss.board[i] + '0'; (*solution)[sz + 1] = '\0'; - /* We don't need the \0 for execute_move (the only user) - * I'm just being printf-friendly in case I wanna print */ } sfree(ss.dsf); @@ -1589,6 +1587,7 @@ static game_state *execute_move(const game_state *state, const char *move) if (*move == 's') { int i = 0; + if (strlen(move) != sz + 1) return NULL; new_state = dup_game(state); for (++move; i < sz; ++i) new_state->board[i] = move[i] - '0'; new_state->cheated = true;