This looks like a bug in slot_by_name:
If the name isn’t valid, you run off the end of the loop, and i is body.count.
Then this bad index is fed to:
The test on body.slots[slot].obj is pointing off the end of the array, and you return… something
slot_by_name() should be returning i where it breaks, and returning an error value at the end, probably -1, and slot_object() should be checking that i is within 0<=I<body.count
Code:
int slot_by_name(struct player *p, const char *name) { int i; /* Look for the correctly named slot */ for (i = 0; i < p->body.count; i++) { if (streq(name, p->body.slots[i].name)) { break; } } /* Index for that slot */ return i; }
Then this bad index is fed to:
Code:
struct object *slot_object(struct player *p, int slot) { /* Ensure a valid body */ if (p->body.slots && p->body.slots[slot].obj) { return p->body.slots[slot].obj; } return NULL; }
slot_by_name() should be returning i where it breaks, and returning an error value at the end, probably -1, and slot_object() should be checking that i is within 0<=I<body.count
Comment