From: Markus Armbruster <armbru@pond.sub.org>
Date: Tue, 20 Mar 2012 19:28:46 +0000 (+0100)
Subject: Fix buffer overflow in build
X-Git-Tag: v4.3.30~41
X-Git-Url: http://git.pond.sub.org/?p=empserver;a=commitdiff_plain;h=5501efa278d7cc2e9420e84ef6ad84188d28ee9b

Fix buffer overflow in build

Remote hole, can smash the stack.  Broken when Empire 2 added the
confirmation prompt.
---

diff --git a/src/lib/commands/buil.c b/src/lib/commands/buil.c
index 01ac73ad7..1228463f6 100644
--- a/src/lib/commands/buil.c
+++ b/src/lib/commands/buil.c
@@ -28,7 +28,7 @@
  *
  *  Known contributors to this file:
  *     Steve McClure, 1998-2000
- *     Markus Armbruster, 2004-2011
+ *     Markus Armbruster, 2004-2012
  */
 
 #include <config.h>
@@ -160,8 +160,8 @@ buil(void)
 	if (number > 20) {
 	    char bstr[80];
 	    sprintf(bstr,
-		    "Are you sure that you want to build %s of them? ",
-		    player->argp[4]);
+		    "Are you sure that you want to build %d of them? ",
+		    number);
 	    p = getstarg(player->argp[6], bstr, buf);
 	    if (!p || *p != 'y')
 		return RET_SYN;