# HG changeset patch # User truelight # Date 1102768212 0 # Node ID a787fc8fba4a7c7b3a9d712e8281065540ae28a8 # Parent 927120a39a1ffc4fc8f5e0d9f3473eee3950e8ac (svn r1018) -Fix: Buffer overflow in edit box, because we misuse maxlen for a flag.. someone should rewrite the editbox! diff -r 927120a39a1f -r a787fc8fba4a misc_gui.c --- a/misc_gui.c Sat Dec 11 12:12:51 2004 +0000 +++ b/misc_gui.c Sat Dec 11 12:30:12 2004 +0000 @@ -17,6 +17,9 @@ bool _query_string_active; void SetFiosType(const byte fiostype); +/* Now this is what I call dirty.. the edit-box needs to be rewritten! */ +static bool _do_edit_on_text_even_when_no_change_to_edit_box; + typedef struct LandInfoData { Town *town; int32 costclear; @@ -780,7 +783,7 @@ case 3: DeleteWindow(w); break; case 4: press_ok:; - if (str_eq(WP(w,querystr_d).buf, WP(w,querystr_d).buf + MAX_QUERYSTR_LEN) && (WP(w,querystr_d).maxlen & 0x1000) == 0) { + if (str_eq(WP(w,querystr_d).buf, WP(w,querystr_d).buf + MAX_QUERYSTR_LEN) && !_do_edit_on_text_even_when_no_change_to_edit_box) { DeleteWindow(w); } else { byte *buf = WP(w,querystr_d).buf; @@ -876,6 +879,13 @@ } else { GetString(_orig_edit_str_buf, str); } + + if (maxlen & 0x1000) { + _do_edit_on_text_even_when_no_change_to_edit_box = true; + maxlen &= ~0x1000; + } else + _do_edit_on_text_even_when_no_change_to_edit_box = false; + _orig_edit_str_buf[maxlen] = 0; memcpy(_edit_str_buf, _orig_edit_str_buf, MAX_QUERYSTR_LEN);