# HG changeset patch
# User John "Elwin" Edwards <elwin@sdf.org>
# Date 1346865274 25200
# Node ID 19903deed3927528b07a101e74aeef3feb8dcf50
# Parent  0fd87c5c5fca81d84ea4c566857413a88d53ee41
arogue5: fix the crash when checking prices in shops.

A buffer called curpurch, which stores a description of an item in a
trading post which the player might be interested in, was only 15
bytes.  It was overflowing into oldrp, a room pointer, leading to
segfaults.  The size of curpurch has been increased to LINELEN*2,
which matches the size of prbuf, which is returned by inv_name and
then strcpy()'d to curpurch.  As long as nothing overflows prbuf it
should be safe now.

NOTE that this breaks savefile compatibility.

diff -r 0fd87c5c5fca -r 19903deed392 arogue5/rogue.c
--- a/arogue5/rogue.c	Mon Aug 20 20:30:19 2012 -0700
+++ b/arogue5/rogue.c	Wed Sep 05 10:14:34 2012 -0700
@@ -65,7 +65,7 @@
 int turns = 0;				/* Number of turns player has taken */
 int quest_item = 0;			/* Item player is looking for */
 char nfloors = -1;			/* Number of floors in this dungeon */
-char curpurch[15];			/* name of item ready to buy */
+char curpurch[LINELEN*2];		/* name of item ready to buy */
 char PLAYER = VPLAYER;			/* what the player looks like */
 char take;				/* Thing the rogue is taking */
 char prbuf[LINELEN*2];			/* Buffer for sprintfs */
diff -r 0fd87c5c5fca -r 19903deed392 arogue5/state.c
--- a/arogue5/state.c	Mon Aug 20 20:30:19 2012 -0700
+++ b/arogue5/state.c	Wed Sep 05 10:14:34 2012 -0700
@@ -2294,7 +2294,7 @@
     rs_write_int(savef, turns);
     rs_write_int(savef, quest_item);
     rs_write_char(savef, nfloors);
-    rs_write(savef, curpurch, 15);
+    rs_write(savef, curpurch, LINELEN*2);
     rs_write_char(savef, PLAYER);
     rs_write_char(savef, take);
     rs_write(savef, prbuf, LINELEN);
@@ -2420,7 +2420,7 @@
     rs_read_int(inf, &turns);
     rs_read_int(inf, &quest_item);
     rs_read_char(inf, &nfloors);
-    rs_read(inf, &curpurch, 15);
+    rs_read(inf, &curpurch, LINELEN*2);
     rs_read_char(inf, &PLAYER);
     rs_read_char(inf, &take);
     rs_read(inf, &prbuf, LINELEN);