Fix off-by-one error that enabled the fuzzer to find a crash hole.

[open-adventure.git] / misc.c

diff --git a/misc.c b/misc.c
index 64c05ceb1fa8c636b2b4659c33ffba8a3d85da90..71c7540669b2b3b8e178220360a89dd4cb8b9ea6 100644 (file)
--- a/misc.c
+++ b/misc.c
@@ -57,7 +57,7 @@ void token_to_packed(char token[6], long* packed)
     {
       if (token[4 - i] == '\0')
        continue;       
-      char mapped = ascii_to_advent[token[4 - i]];
+      char mapped = ascii_to_advent[(int) token[4 - i]];
       *packed |= (mapped << (6 * i));
     }
 }
@@ -291,7 +291,7 @@ bool YES(const char* question, const char* yes_response, const char* no_response
 
         reply = get_input();
 
-        char* firstword = (char*) xmalloc(strlen(reply));
+        char* firstword = (char*) xmalloc(strlen(reply)+1);
         sscanf(reply, "%s", firstword);
 
         for (int i = 0; i < (int)strlen(firstword); ++i)