fix buffer overrun when matching spell syllables

  Thankfully this triggered a stack check assertion, causing the
application to crash and exposing the bug. Thanks to dajotsa from
OTLand for reporting it.

2 files changed, 12 insertions, 10 deletions

diff --git a/src/common.hh b/src/common.hh
index a22a511..28b48de 100644
--- a/src/common.hh
+++ b/src/common.hh
@@ -101,6 +101,8 @@ STATIC_ASSERT(OS_LINUX);
 //#define MAX_QUESTS 500
 #define MAX_DEPOTS 9
 //#define MAX_OPEN_CONTAINERS 16
+#define MAX_SPELL_SYLLABLES 10
+
 
 // shm.cc
 // =============================================================================
diff --git a/src/magic.cc b/src/magic.cc
index 8c6b3d8..7c0e4f5 100644
--- a/src/magic.cc
+++ b/src/magic.cc
@@ -8,14 +8,8 @@
 #include <fstream>
 #include <sstream>
 
-struct TCircle {
-	int x[32];
-	int y[32];
-	int Count;
-};
-
 struct TSpellList {
-	uint8 Syllable[10];
+	uint8 Syllable[MAX_SPELL_SYLLABLES];
 	uint8 RuneGr;
 	uint8 RuneNr;
 	const char *Comment;
@@ -27,6 +21,12 @@ struct TSpellList {
 	int Amount;
 };
 
+struct TCircle {
+	int x[32];
+	int y[32];
+	int Count;
+};
+
 static TSpellList SpellList[256];
 static TCircle Circle[10];
 
@@ -3926,14 +3926,14 @@ int CheckForSpell(uint32 CreatureID, const char *Text){
 	// specially for the minimal processing we're doing here.
 
 	int SyllableCount = 1;
-	uint8 Syllable[10] = { (uint8)SpellType };
-	char SpellStr[10][512] = {};
+	uint8 Syllable[MAX_SPELL_SYLLABLES] = { (uint8)SpellType };
+	char SpellStr[MAX_SPELL_SYLLABLES][512] = {};
 	strcpy(SpellStr[0], SpellSyllable[SpellType]);
 
 	std::istringstream IS(Text);
 	IS.get();
 	IS.get();
-	while(!IS.eof()){
+	while(!IS.eof() && SyllableCount < MAX_SPELL_SYLLABLES){
 		while(isSpace(IS.peek())){
 			IS.get();
 		}