(retr, lretr, doship, dounit): Zero-terminate retreat paths. The last

character in the array must be zero already.  Closes #1225708.

diff --git a/src/lib/commands/edit.c b/src/lib/commands/edit.c
index bfaeff6c091633cb54ddf35b9aa4da74852ce78e..f49f0c4e91e4afa3c4511f45c1ce94315b2ae7b7 100644 (file)
--- a/src/lib/commands/edit.c
+++ b/src/lib/commands/edit.c
@@ -808,7 +808,7 @@ doship(s_char op, int arg, s_char *p, struct shpstr *ship)
        ship->shp_ptime = arg;
        break;
     case 'R':
-       memcpy(ship->shp_rpath, p, sizeof(ship->shp_rpath));
+       strncpy(ship->shp_rpath, p, sizeof(ship->shp_rpath) - 1);
        break;
     case 'W':
        ship->shp_rflags = arg;
@@ -1006,7 +1006,7 @@ dounit(s_char op, int arg, s_char *p, float farg, struct lndstr *land)
        land->lnd_retreat = arg;
        break;
     case 'R':
-       memcpy(land->lnd_rpath, p, sizeof(land->lnd_rpath));
+       strncpy(land->lnd_rpath, p, sizeof(land->lnd_rpath) - 1);
        break;
     case 'W':
        land->lnd_rflags = arg;

diff --git a/src/lib/commands/retr.c b/src/lib/commands/retr.c
index 1876a88babd63bbe5f3e3df1d202200fdb7f75a1..dc617e2de54a5eec3bf9cb31e55e519dca6e4988 100644 (file)
--- a/src/lib/commands/retr.c
+++ b/src/lib/commands/retr.c
@@ -142,7 +142,7 @@ retr(void)
            memset(ship.shp_rpath, 0, sizeof(ship.shp_rpath));
 
        if (pq != NULL) {
-           strncpy(ship.shp_rpath, pq, sizeof(ship.shp_rpath));
+           strncpy(ship.shp_rpath, pq, sizeof(ship.shp_rpath) - 1);
            putship(ship.shp_uid, &ship);
        }
        if (rflags >= 0) {
@@ -269,7 +269,7 @@ lretr(void)
            memset(land.lnd_rpath, 0, sizeof(land.lnd_rpath));
 
        if (pq != NULL) {
-           strncpy(land.lnd_rpath, pq, sizeof(land.lnd_rpath));
+           strncpy(land.lnd_rpath, pq, sizeof(land.lnd_rpath) - 1);
            putland(land.lnd_uid, &land);
        }
        if (rflags >= 0) {