http://eressea.upb.de/mantis/view.php?id=561

Kampf crasht mit Datenfile 420

Da waren 50 Armeen in einer Region, das hat einen string-buffer auf dem stack von battle_report gekillt.

src/common/kernel/battle.c

@@ -51,17 +51,17 @@
 #include <items/demonseye.h>
 
 /* util includes */
-#include <base36.h>
-#include <cvector.h>
-#include <rand.h>
-#include <log.h>
+#include <util/base36.h>
+#include <util/bsdstring.h>
+#include <util/cvector.h>
+#include <util/rand.h>
+#include <util/log.h>
 
 /* libc includes */
 #include <assert.h>
 #include <ctype.h>
 #include <limits.h>
 #include <math.h>
-#include <message.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
@@ -3284,7 +3284,7 @@ battle_report(battle * b)
 	side *s, *s2;
 	boolean cont = false;
 	boolean komma;
-	char buf2[1024];
+	char * bufp = buf;
 	bfaction *bf;
 
 	buf[0] = 0;
@@ -3314,7 +3314,6 @@ battle_report(battle * b)
     message_faction(b, fac, m);
     msg_release(m);
 
-		buf2[0] = 0;
     komma   = false;
     cv_foreach(s, b->sides) {
       if (s->alive) {
@@ -3322,8 +3321,15 @@ battle_report(battle * b)
 				int l = FIGHT_ROW;
 				const char * abbrev = seematrix(fac, s)?sideabkz(s, false):"-?-";
 				const char * loc_army = LOC(fac->locale, "battle_army");
-				sprintf(buf, "%s%s %2d(%s): ", (komma==true?", ":""), 
+        char buffer[32];
+
+        if (komma) bufp += strlcpy(bufp, ", ", sizeof(buf) - (bufp - buf));
+        snprintf(buffer, sizeof(buffer), "%s %2d(%s): ", 
           loc_army, s->index, abbrev);
+        buffer[sizeof(buffer)-1] = 0;
+
+        bufp += strlcpy(bufp, buffer, sizeof(buf) - (bufp - buf));
+
 				for (r=FIGHT_ROW;r!=NUMROWS;++r) {
 					if (alive[r]) {
 						if (l!=FIGHT_ROW) scat("+");
@@ -3334,13 +3340,10 @@ battle_report(battle * b)
 					} else ++k;
 				}
 
-				strcat(buf2, buf);
-				if (komma == false) {
         komma = true;
 			}
-			}
 		} cv_next(s);
-		fbattlerecord(b, fac, buf2);
+		fbattlerecord(b, fac, buf);
 	}
 	return cont;
 }