package/games/bsd-games/CVE-2006-1539.patch

   1 # --- T2-COPYRIGHT-NOTE-BEGIN ---
   2 # This copyright note is auto-generated by ./scripts/Create-CopyPatch.
   3 #
   4 # T2 SDE: package/.../bsd-games/CVE-2006-1539.patch
   5 # Copyright (C) 2006 The T2 SDE Project
   6 #
   7 # More information can be found in the files COPYING and README.
   8 #
   9 # This patch file is dual-licensed. It is available under the license the
  10 # patched project is licensed under, as long as it is an OpenSource license
  11 # as defined at http://www.opensource.org/ (e.g. BSD, X11) or under the terms
  12 # of the GNU General Public License as published by the Free Software
  13 # Foundation; either version 2 of the License, or (at your option) any later
  14 # version.
  15 # --- T2-COPYRIGHT-NOTE-END ---
  16
  17 diff -Nur bsd-games-2.17-orig/tetris/scores.c bsd-games-2.17/tetris/scores.c
  18 --- bsd-games-2.17-orig/tetris/scores.c 2004-01-27 20:52:07.000000000 +0000
  19 +++ bsd-games-2.17/tetris/scores.c      2006-06-02 11:14:21.000000000 +0000
  20 @@ -335,7 +335,8 @@
  21                                 continue;
  22                         }
  23                 }
  24 -               levelfound[sp->hs_level] = 1;
  25 +        if (sp->hs_level < NLEVELS && sp->hs_level >= 0)
  26 +               levelfound[sp->hs_level] = 1;
  27                 i++, sp++;
  28         }
  29         return (num > MAXHISCORES ? MAXHISCORES : num);
  30 @@ -374,12 +375,14 @@
  31         for (i = MINLEVEL; i < NLEVELS; i++)
  32                 levelfound[i] = 0;
  33         for (i = 0, sp = scores; i < nscores; i++, sp++) {
  34 -               if (levelfound[sp->hs_level])
  35 -                       sp->hs_time = 0;
  36 -               else {
  37 -                       sp->hs_time = 1;
  38 -                       levelfound[sp->hs_level] = 1;
  39 -               }
  40 +        if (sp->hs_level < NLEVELS && sp->hs_level >= 0) {
  41 +               if (levelfound[sp->hs_level])
  42 +                       sp->hs_time = 0;
  43 +                   else {
  44 +                           sp->hs_time = 1;
  45 +                       levelfound[sp->hs_level] = 1;
  46 +                   }
  47 +        }
  48         }
  49
  50         /*
  51 @@ -433,7 +436,7 @@
  52                                 continue;
  53                         }
  54                         sp = &hs[item];
  55 -                       (void)sprintf(buf,
  56 +                       (void)snprintf(buf, sizeof(buf),
  57                             "%3d%c %6d  %-11s (%6d on %d)",
  58                             item + offset, sp->hs_time ? '*' : ' ',
  59                             sp->hs_score * sp->hs_level,