Each file in this commit has the issue where it is possible for code to

overrun static buffers. This could lead to serious problems. Granted it
is almost impossible to do that. But it isn't totally impossible. So this
commit makes it impossible to overrun.

6 files changed, 51 insertions, 38 deletions

diff --git a/noncore/games/backgammon/moveengine.cpp b/noncore/games/backgammon/moveengine.cpp
index a4145cc..b102258 100644
--- a/noncore/games/backgammon/moveengine.cpp
+++ b/noncore/games/backgammon/moveengine.cpp
@@ -50,13 +50,14 @@ void MoveEngine::position(Pieces& pieces,bool non_qte)
     for(int a=0;a<28;a++)
     {
         for(int b=0;b<abs(population[a].total);b++)
         {
             if(population[a].total>0) //player 1 pieces
             {
-                pieces.player1[player1_counter].x=x_coord[a]-offset;
+		if (a < 26)
+                    pieces.player1[player1_counter].x=x_coord[a]-offset;
                 if(a>=0 && a<13)
                 {
                     pieces.player1[player1_counter].y=yup_coord[b]-offset;
                     pieces.player1[player1_counter].z=z_coord[b];
                     pieces.player1[player1_counter].side=false;
                     player1_counter++;
@@ -93,13 +94,14 @@ void MoveEngine::position(Pieces& pieces,bool non_qte)
 
                 }
             }
 
             else if(population[a].total<0) //player 2 pieces
             {
-                pieces.player2[player2_counter].x=x_coord[a]-offset;
+		if (a < 26)
+                    pieces.player2[player2_counter].x=x_coord[a]-offset;
                 if(a>=0 && a<13)
                 {
                     pieces.player2[player2_counter].y=yup_coord[b]-offset;
                     pieces.player2[player2_counter].z=z_coord[b];
                     pieces.player2[player2_counter].side=false;
                     player2_counter++;
diff --git a/noncore/games/kbill/UI.cpp b/noncore/games/kbill/UI.cpp
index 611cebf..a49c3c1 100644
--- a/noncore/games/kbill/UI.cpp
+++ b/noncore/games/kbill/UI.cpp
@@ -65,34 +65,33 @@ void UI::make_mainwin() {
 }
 
 void UI::popup_dialog (int dialog) {
 	kill_timer();
 	switch (dialog) {
 	case Game::ENDGAME:
-			QMessageBox::message(("Endgame"), QT_TR_NOOP(endgamestr));
-			break;
+		QMessageBox::message(("Endgame"), QT_TR_NOOP(endgamestr));
+		break;
 	case Game::HIGHSCORE:
-		//	QMessageBox::message(("HighScore"), highscorestr);
-			break;
-	case Game::ENTERNAME: {
+		break;
+	case Game::ENTERNAME:
+		{
 			InputBox b(main, 0, ("Enter Name"), QT_TR_NOOP(enternamestr));
 			bool state = b.exec() == 2;
-		  char str[20], *nl;
-	    strcpy(str, b.getText());
-	    if (!str[0] || state)
+			char str[20], *nl;
+			strncpy(str, b.getText(), 19);
+	    		if (!str[0] || state)
 				strcpy(str, "Anonymous");
-	    else if ((nl = strchr(str, '\n')))
+			else if ((nl = strchr(str, '\n')))
 				*nl = '\0';
-	    if (strlen(str) > 20)
-				str[20] = 0;  /* truncate string if too long */
-//	    scores.recalc(str);
-			}
-	    break;
+			if (strlen(str) > 19)
+				str[19] = '\0';  /* truncate/terminate the string if it is too long */
+		}
+		break;
 	case Game::SCORE:
-			QMessageBox::message(("Score"), scorestr);
-			break;
+		QMessageBox::message(("Score"), scorestr);
+		break;
 	}
 	restart_timer();
 }
 
 /*********************/
 /* Graphics routines */
diff --git a/noncore/games/kcheckers/echeckers.cpp b/noncore/games/kcheckers/echeckers.cpp
index 1146059..afe62eb 100644
--- a/noncore/games/kcheckers/echeckers.cpp
+++ b/noncore/games/kcheckers/echeckers.cpp
@@ -76,15 +76,15 @@ bool ECheckers::checkCapture1()
       case KING1:
         if(board[i-6]==MAN2 || board[i-6]==KING2)
           if(board[i-12]==FREE) return true;
         if(board[i-5]==MAN2 || board[i-5]==KING2)
           if(board[i-10]==FREE) return true;
         if(board[i+5]==MAN2 || board[i+5]==KING2)
-          if(board[i+10]==FREE) return true;
+          if(board[((i+10) < 54) ? i+10 : 53]==FREE) return true;
         if(board[i+6]==MAN2 || board[i+6]==KING2)
-          if(board[i+12]==FREE) return true;
+          if(board[((i+12) < 54) ? i+12 : 53]==FREE) return true;
     }
   }
   return false;
 }
 
 
@@ -218,25 +218,25 @@ bool ECheckers::checkCapture2()
   for(int i=6;i<48;i++)
   {
     switch(board[i])
     {
       case MAN2:
         if(board[i+5]==MAN1 || board[i+5]==KING1)
-          if(board[i+10]==FREE) return true;
+          if(board[((i+10) < 54) ? i+10 : 53]==FREE) return true;
         if(board[i+6]==MAN1 || board[i+6]==KING1)
-          if(board[i+12]==FREE) return true;
+          if(board[((i+12) < 54) ? i+12 : 53]==FREE) return true;
         break;
       case KING2:
         if(board[i-6]==MAN1 || board[i-6]==KING1)
           if(board[i-12]==FREE) return true;
         if(board[i-5]==MAN1 || board[i-5]==KING1)
           if(board[i-10]==FREE) return true;
         if(board[i+5]==MAN1 || board[i+5]==KING1)
-          if(board[i+10]==FREE) return true;
+          if(board[((i+10) < 54) ? i+10 : 53]==FREE) return true;
         if(board[i+6]==MAN1 || board[i+6]==KING1)
-          if(board[i+12]==FREE) return true;
+          if(board[((i+12) < 54) ? i+12 : 53]==FREE) return true;
     }
   }
   return false;
 }
 
 
diff --git a/noncore/games/kcheckers/rcheckers.cpp b/noncore/games/kcheckers/rcheckers.cpp
index a1c7afa..d808780 100644
--- a/noncore/games/kcheckers/rcheckers.cpp
+++ b/noncore/games/kcheckers/rcheckers.cpp
@@ -109,33 +109,39 @@ bool RCheckers::checkCapture1()
       case MAN1:
         if(board[i-6]==MAN2 || board[i-6]==KING2)
           if(board[i-12]==FREE) return true;
         if(board[i-5]==MAN2 || board[i-5]==KING2)
           if(board[i-10]==FREE) return true;
         if(board[i+5]==MAN2 || board[i+5]==KING2)
-          if(board[i+10]==FREE) return true;
+          if(board[((i+10) < 54) ? i+10 : 53]==FREE) return true;
         if(board[i+6]==MAN2 || board[i+6]==KING2)
-          if(board[i+12]==FREE) return true;
+          if(board[((i+12) < 54) ? i+12 : 53]==FREE) return true;
         break;
       case KING1:
         int k;
         for(k=i-6;board[k]==FREE;k-=6);
         if(board[k]==MAN2 || board[k]==KING2)
           if(board[k-6]==FREE) return true;
 
         for(k=i-5;board[k]==FREE;k-=5);
         if(board[k]==MAN2 || board[k]==KING2)
           if(board[k-5]==FREE) return true;
 
-        for(k=i+5;board[k]==FREE;k+=5);
+        for(k=i+5;board[k]==FREE;k+=5) {
+          if (k >= 49)
+            break;
+        }
         if(board[k]==MAN2 || board[k]==KING2)
-          if(board[k+5]==FREE) return true;
+          if(board[((k+5) < 54) ? k+5 : 53]==FREE) return true;
 
-        for(k=i+6;board[k]==FREE;k+=6);
+        for(k=i+6;board[k]==FREE;k+=6) {
+          if (k >=48)
+            break;
+        }
         if(board[k]==MAN2 || board[k]==KING2)
-          if(board[k+6]==FREE) return true;
+          if(board[((k+6) < 54) ? k+6 : 53]==FREE) return true;
     }
   }
   return false;
 }
 
 
@@ -283,33 +289,39 @@ bool RCheckers::checkCapture2()
       case MAN2:
         if(board[i-6]==MAN1 || board[i-6]==KING1)
           if(board[i-12]==FREE) return true;
         if(board[i-5]==MAN1 || board[i-5]==KING1)
           if(board[i-10]==FREE) return true;
         if(board[i+5]==MAN1 || board[i+5]==KING1)
-          if(board[i+10]==FREE) return true;
+          if(board[((i+10) < 54) ? i+10 : 53]==FREE) return true;
         if(board[i+6]==MAN1 || board[i+6]==KING1)
-          if(board[i+12]==FREE) return true;
+          if(board[((i+12) < 54) ? i+12 : 53]==FREE) return true;
         break;
       case KING2:
         int k;
         for(k=i-6;board[k]==FREE;k-=6);
         if(board[k]==MAN1 || board[k]==KING1)
           if(board[k-6]==FREE) return true;
 
         for(k=i-5;board[k]==FREE;k-=5);
         if(board[k]==MAN1 || board[k]==KING1)
           if(board[k-5]==FREE) return true;
 
-        for(k=i+5;board[k]==FREE;k+=5);
+        for(k=i+5;board[k]==FREE;k+=5) {
+          if (k>=49)
+            break;
+        }
         if(board[k]==MAN1 || board[k]==KING1)
-          if(board[k+5]==FREE) return true;
+          if(board[((k+5) < 54) ? k+5 : 53]==FREE) return true;
 
-        for(k=i+6;board[k]==FREE;k+=6);
+        for(k=i+6;board[k]==FREE;k+=6) {
+          if (k>=48)
+            break;
+        }
         if(board[k]==MAN1 || board[k]==KING1)
-          if(board[k+6]==FREE) return true;
+          if(board[((k+6) < 54) ? k+6 : 53]==FREE) return true;
     }
   }
   return false;
 }
 
 
diff --git a/noncore/settings/sysinfo/contrib/fft.c b/noncore/settings/sysinfo/contrib/fft.c
index 01a1b26..60ee27d 100644
--- a/noncore/settings/sysinfo/contrib/fft.c
+++ b/noncore/settings/sysinfo/contrib/fft.c
@@ -26,13 +26,13 @@
 //
 // Copyright (C) Satoshi 1994-2002 All rights reserved.
 // ***********************************************************************
 
 #include <math.h>
 
-#define       FFT_TEST_COUNT      500                 // Bench FFT
+#define       FFT_TEST_COUNT      332                 // Bench FFT
 
 // ----------------------------------------------------- FFT
 #define       OBJ_DATA_COUNT      128
 #define       OBJ_DATA_SISU       7                   // 128 = 2 ** 7
 #define       OBJ_DATA_SLIDE      1
 
diff --git a/noncore/styles/theme/othemebase.cpp b/noncore/styles/theme/othemebase.cpp
index 4275dd6..7fb12a3 100644
--- a/noncore/styles/theme/othemebase.cpp
+++ b/noncore/styles/theme/othemebase.cpp
@@ -1001,13 +1001,13 @@ void OThemeBase::readResourceGroup( int i, QString *copyfrom, QString *pixnames,
                 if ( !loadArray[ sIndex ] )  // hasn't been loaded yet
                     readResourceGroup( sIndex, copyfrom, pixnames, brdnames,
                                        loadArray );
                 break;
             }
         }
-        if ( loadArray[ sIndex ] ) {
+        if ( sIndex < 54 && loadArray[ sIndex ] ) {
             copyWidgetConfig( sIndex, i, pixnames, brdnames );
         }
         else
             odebug << "OThemeBase: Unable to identify source widget for " << widgetEntries[ i ] << oendl;
         return ;
     }