From 5d6e8c0685f2f03c48a0c813f67c143b82f6af94 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@pond.sub.org>
Date: Sun, 26 Mar 2006 14:42:27 +0000
Subject: [PATCH] (retr, lretr, doship, dounit): Zero-terminate retreat paths. 
 The last character in the array must be zero already.  Closes #1225708.

---
 src/lib/commands/edit.c | 4 ++--
 src/lib/commands/retr.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/lib/commands/edit.c b/src/lib/commands/edit.c
index bfaeff6c..f49f0c4e 100644
--- a/src/lib/commands/edit.c
+++ b/src/lib/commands/edit.c
@@ -808,7 +808,7 @@ doship(s_char op, int arg, s_char *p, struct shpstr *ship)
 	ship->shp_ptime = arg;
 	break;
     case 'R':
-	memcpy(ship->shp_rpath, p, sizeof(ship->shp_rpath));
+	strncpy(ship->shp_rpath, p, sizeof(ship->shp_rpath) - 1);
 	break;
     case 'W':
 	ship->shp_rflags = arg;
@@ -1006,7 +1006,7 @@ dounit(s_char op, int arg, s_char *p, float farg, struct lndstr *land)
 	land->lnd_retreat = arg;
 	break;
     case 'R':
-	memcpy(land->lnd_rpath, p, sizeof(land->lnd_rpath));
+	strncpy(land->lnd_rpath, p, sizeof(land->lnd_rpath) - 1);
 	break;
     case 'W':
 	land->lnd_rflags = arg;
diff --git a/src/lib/commands/retr.c b/src/lib/commands/retr.c
index 1876a88b..dc617e2d 100644
--- a/src/lib/commands/retr.c
+++ b/src/lib/commands/retr.c
@@ -142,7 +142,7 @@ retr(void)
 	    memset(ship.shp_rpath, 0, sizeof(ship.shp_rpath));
 
 	if (pq != NULL) {
-	    strncpy(ship.shp_rpath, pq, sizeof(ship.shp_rpath));
+	    strncpy(ship.shp_rpath, pq, sizeof(ship.shp_rpath) - 1);
 	    putship(ship.shp_uid, &ship);
 	}
 	if (rflags >= 0) {
@@ -269,7 +269,7 @@ lretr(void)
 	    memset(land.lnd_rpath, 0, sizeof(land.lnd_rpath));
 
 	if (pq != NULL) {
-	    strncpy(land.lnd_rpath, pq, sizeof(land.lnd_rpath));
+	    strncpy(land.lnd_rpath, pq, sizeof(land.lnd_rpath) - 1);
 	    putland(land.lnd_uid, &land);
 	}
 	if (rflags >= 0) {