Fix memory stomp due to inconsistent inventory layout

Source/inv.cpp

@@ -13,10 +13,10 @@
 #include <SDL3/SDL_keyboard.h>
 #include <SDL3/SDL_rect.h>
 #else
 #include <SDL.h>
 #endif
 
 #include <fmt/format.h>
 
 #include "DiabloUI/ui_flags.hpp"
 #include "controls/control_mode.hpp"
@@ -29,26 +29,26 @@
 #include "engine/render/clx_render.hpp"
 #include "engine/render/text_render.hpp"
 #include "engine/size.hpp"
 #include "hwcursor.hpp"
 #include "inv_iterators.hpp"
 #include "levels/tile_properties.hpp"
 #include "levels/town.h"
 #include "minitext.h"
 #include "options.h"
 #include "panels/ui_panels.hpp"
 #include "player.h"
 #include "plrmsg.h"
 #include "qol/stash.h"
 #include "stores.h"
 #include "towners.h"
 #include "utils/display.h"
 #include "utils/format_int.hpp"
 #include "utils/is_of.hpp"
 #include "utils/language.h"
 #include "utils/sdl_geometry.h"
 #include "utils/str_cat.hpp"
 #include "utils/utf8.hpp"
 
 namespace devilution {
 
 bool invflag;
@@ -76,7 +76,7 @@
  * @endcode
  */
 const Rectangle InvRect[] = {
 	// clang-format off
 	//{   X,   Y }, {  W,  H }
 	{ { 132,   2 }, { 58, 59 } }, // helmet
 	{ {  47, 177 }, { 28, 29 } }, // left ring
@@ -152,10 +152,10 @@
 	const int pitch = 10;
 	for (int y = 0; y < itemSize.height; y++) {
 		const int rowGridIndex = invGridIndex + pitch * y;
 		for (int x = 0; x < itemSize.width; x++) {
 			if (x == 0 && y == itemSize.height - 1)
 				player.InvGrid[rowGridIndex + x] = invListIndex;
 			else
 				player.InvGrid[rowGridIndex + x] = -invListIndex; // use negative index to denote it's occupied but it's not the top-left cell.
 		}
 	}
@@ -1565,29 +1565,39 @@
 	CalcPlrInv(player, player._pmode != PM_DEATH);
 }
 
-void CheckInvSwap(Player &player, const Item &item, int invGridIndex)
+bool CheckInvSwap(Player &player, const Item &item, int invGridIndex)
 {
 	Size itemSize = GetInventorySize(item);
 
 	const int pitch = 10;
-	const int invListIndex = [&]() -> int {
-		for (int y = 0; y < itemSize.height; y++) {
-			const int rowGridIndex = invGridIndex + pitch * y;
-			for (int x = 0; x < itemSize.width; x++) {
-				const int gridIndex = rowGridIndex + x;
-				if (player.InvGrid[gridIndex] != 0)
-					return std::abs(player.InvGrid[gridIndex]);
+	if (invGridIndex + itemSize.width - 1 + pitch * (itemSize.height - 1) >= InventoryGridCells)
+		return false;
+
+	int invListIndex = 0;
+	for (int y = 0; y < itemSize.height; y++) {
+		int rowGridIndex = invGridIndex + pitch * y;
+		for (int x = 0; x < itemSize.width; x++) {
+			int gridIndex = rowGridIndex + x;
+			if (player.InvGrid[gridIndex] != 0) {
+				int existingItem = std::abs(player.InvGrid[gridIndex]);
+				if (!invListIndex) {
+					invListIndex = existingItem;
+				} else if (invListIndex != existingItem) {
+					// More than one item exists where we want to place the new item
+					return false;
+				}
 			}
 		}
-		player._pNumInv++;
-		return player._pNumInv;
-	}();
+	}
 
-	if (invListIndex < player._pNumInv) {
-		for (int8_t &itemIndex : player.InvGrid) {
-			if (itemIndex == invListIndex)
-				itemIndex = 0;
-			if (itemIndex == -invListIndex)
+	if (!invListIndex) {
+		// The inventory is empty where we want to place the new item.  Allocate a new spot.
+		player._pNumInv++;
+		invListIndex = player._pNumInv;
+	} else {
+		// Remove the old location of the existing item
+		for (int8_t& itemIndex : player.InvGrid) {
+			if (std::abs(itemIndex) == invListIndex)
 				itemIndex = 0;
 		}
 	}
@@ -1605,6 +1615,7 @@
 	}
 
 	CalcPlrInv(player, true);
+	return true;
 }
 
 void CheckInvRemove(Player &player, int invGridIndex)

Source/inv.h

@@ -188,7 +188,7 @@ int AddGoldToInventory(Player &player, int value);
 bool GoldAutoPlace(Player &player, Item &goldStack);
 void CheckInvSwap(Player &player, inv_body_loc bLoc);
 void inv_update_rem_item(Player &player, inv_body_loc iv);
-void CheckInvSwap(Player &player, const Item &item, int invGridIndex);
+bool CheckInvSwap(Player &player, const Item &item, int invGridIndex);
 void CheckInvRemove(Player &player, int invGridIndex);
 void TransferItemToStash(Player &player, int location);
 void CheckInvItem(bool isShiftHeld = false, bool isCtrlHeld = false);

Source/msg.cpp

@@ -2172,7 +2172,10 @@ size_t OnChangeInventoryItems(const TCmdChItem &message, Player &player)
 	} else if (&player != MyPlayer && IsItemAvailable(static_cast<_item_indexes>(Swap16LE(message.def.wIndx)))) {
 		Item item {};
 		RecreateItem(player, message, item);
-		CheckInvSwap(player, item, message.bLoc);
+		if (!CheckInvSwap(player, item, message.bLoc)) {
+			// item is larger than 1x1, and it occupies invalid inventory slots
+			return sizeof(message);
+		}
 	}
 
 	return sizeof(message);