This looks like a bug in slot_by_name:
If the name isn’t valid, you run off the end of the loop, and i is body.count.
Then this bad index is fed to:
The test on body.slots[slot].obj is pointing off the end of the array, and you return… something
slot_by_name() should be returning i where it breaks, and returning an error value at the end, probably -1, and slot_object() should be checking that i is within 0<=I<body.count
Code:
int slot_by_name(struct player *p, const char *name)
{
int i;
/* Look for the correctly named slot */
for (i = 0; i < p->body.count; i++) {
if (streq(name, p->body.slots[i].name)) {
break;
}
}
/* Index for that slot */
return i;
}
Then this bad index is fed to:
Code:
struct object *slot_object(struct player *p, int slot)
{
/* Ensure a valid body */
if (p->body.slots && p->body.slots[slot].obj) {
return p->body.slots[slot].obj;
}
return NULL;
}
slot_by_name() should be returning i where it breaks, and returning an error value at the end, probably -1, and slot_object() should be checking that i is within 0<=I<body.count
Comment