popen.c (ftpd_popen): Make sure you can't overrun the argv[] and

	gargv[] arrays.  (Patch submitted by dima@best.net).

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@10419 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/appl/gssftp/ftpd/ChangeLog b/src/appl/gssftp/ftpd/ChangeLog
index 50256487f87cacbb36acdd94dbb1fc796afaf1b6..18377bb55b04ecdd76cd9669a477b435bfef566f 100644 (file)
--- a/src/appl/gssftp/ftpd/ChangeLog
+++ b/src/appl/gssftp/ftpd/ChangeLog
@@ -1,3 +1,8 @@
+Fri Feb  6 13:25:28 1998  Theodore Y. Ts'o  <tytso@mit.edu>
+
+       * popen.c (ftpd_popen): Make sure you can't overrun the argv[] and
+               gargv[] arrays.  (Patch submitted by dima@best.net).
+
 Thu Jan 29 19:51:02 1998  Dan Winship  <danw@mit.edu>
 
        * ftpd.c (auth_data): Accept forwarded credentials and dispose of

diff --git a/src/appl/gssftp/ftpd/popen.c b/src/appl/gssftp/ftpd/popen.c
index 89f29a2069a57bb2a45a8aeb7c9a89921906b7b1..ffafe05296290b192882ccf7e2a7ed71def10ff5 100644 (file)
--- a/src/appl/gssftp/ftpd/popen.c
+++ b/src/appl/gssftp/ftpd/popen.c
@@ -58,6 +58,8 @@ static char sccsid[] = "@(#)popen.c   5.9 (Berkeley) 2/25/91";
 static int *pids;
 static int fds;
 
+#define MAX_ARGV       100
+#define MAX_GARGV      1000
 
 FILE *
 ftpd_popen(program, type)
@@ -66,7 +68,7 @@ ftpd_popen(program, type)
        register char *cp;
        FILE *iop;
        int argc, gargc, pdes[2], pid;
-       char **pop, *argv[100], *gargv[1000], *vv[2];
+       char **pop, *argv[MAX_ARGV], *gargv[MAX_GARGV], *vv[2];
        extern char **ftpglob(), **copyblk();
 
        if (*type != 'r' && *type != 'w' || type[1])
@@ -83,10 +85,12 @@ ftpd_popen(program, type)
                return(NULL);
 
        /* break up string into pieces */
-       for (argc = 0, cp = program;; cp = NULL)
+       for (argc = 0, cp = program; argc < MAX_ARGV - 1; cp = NULL)
                if (!(argv[argc++] = strtok(cp, " \t\n")))
                        break;
-       for (argc = 0; argv[argc]; argc++) argv[argc] = strdup(argv[argc]);
+       argv[MAX_ARGV-1] = NULL;
+       for (argc = 0; argv[argc]; argc++)
+               argv[argc] = strdup(argv[argc]);
 
        /* glob each piece */
        gargv[0] = argv[0];
@@ -97,7 +101,7 @@ ftpd_popen(program, type)
                        pop = copyblk(vv);
                }
                argv[argc] = (char *)pop;               /* save to free later */
-               while (*pop && gargc < 1000)
+               while (*pop && gargc < MAX_GARGV)
                        gargv[gargc++] = *pop++;
        }
        gargv[gargc] = NULL;