Well, Mark, it seems your fixes have repaired the obvious problems. However, I also looked at the crash with a debugger and it wasn't clear to me either why what you did would have made it crash. poking 0 to element 127 of a 256-long buffer.... should not have crashed. Perhaps something more subtle was going on? PeterM > Both client & server checkins. Log entries below: > > Server: > > MSW 2000-11-07 > common/item.c: query_base_name was not return plural version of items > with 'of' in name. Also, much of the function was not using safe_strcat, > which could result in buffer overlow problems. > > common/object.c: Change update_position so that we always generate > 3 images per space. This fixes players standing on top of dragon transports, > but generally works for things like monsters standing on objects. > insert_ob_in_map: change 'return' statement to 'return NULL'. Also > remove unused map pointer. > decrease_ob_nr: Fix bug for client updates when player drops item that > is then consume. It was using op->above after object was removed to > find the player. Store above pointer before we remove the object. > > socket/item.c: Don't terminate pointer as returned by query_base_name - > instead, terminator buffer after we copy it. For simple object, > query_base_name may directly return a pointer to the objects name > which is only long enough to hold the name itself. > > socket/lowlevel.c: Abort if we are trying to send the client a packet > longer than supported by the protocol. Since that buffer is static, > overflowing it will just create memory corruption - easier to stop > then than try and debug it later. > > End of MSW checkin 2000-11-7 > > Client > Checkin on 2000-11-7 by MSW: > item.h: Update NAME_LEN to 128, as the server may send us names that > long. Also, terminate the name after we copy it. > _______________________________________________ > crossfire-devel mailing list > crossfire-devel at lists.real-time.com > https://mailman.real-time.com/mailman/listinfo/crossfire-devel