* krshd.c (doit): For encrypted rcp, fix logic in determining

		executable to run.

The real bug was that for encrypted rcp, it was checking (with stat) if
"-x ....../rcp" existed instead of "..../rcp"

Another change is so that freed memory is not accessed.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@7610 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/appl/bsd/krlogind.M b/src/appl/bsd/krlogind.M
index c76b99cab635f665d677ddc282b8bfe513376a68..1be7136293159d2bac0decf24c5a60e4f933b68e 100644 (file)
--- a/src/appl/bsd/krlogind.M
+++ b/src/appl/bsd/krlogind.M
@@ -84,7 +84,7 @@ client is trying to access in the initial authenticator.  This
 checksum provides additionl security by preventing an attacker from
 changing the initial connection information.  To benefit from this
 security, only Kerberos5 should be trusted; Kerberos4 and rhosts
-authentication do not include this checksum.  If thi options is
+authentication do not include this checksum.  If this options is
 specified, older Kerberos5 clients that do not send a checksum in the
 authenticator will not be able to authenticate to this server.
 .PP

diff --git a/src/appl/bsd/krshd.c b/src/appl/bsd/krshd.c
index 98d49744c9a53d2e7f99099920e5381c8de02547..1573939a9142a5b77e64bf4d9e89164f773c610d 100644 (file)
--- a/src/appl/bsd/krshd.c
+++ b/src/appl/bsd/krshd.c
@@ -1299,12 +1299,6 @@ envinit[i] =buf;
     }
     environ = envinit;
     
-    cp = strrchr(pwd->pw_shell, '/');
-    if (cp)
-      cp++;
-    else
-      cp = pwd->pw_shell;
-    
 #ifdef KERBEROS
     /* To make Kerberos rcp work correctly, we must ensure that we
        invoke Kerberos rcp on this end, not normal rcp, even if the
@@ -1313,6 +1307,7 @@ envinit[i] =buf;
        (do_encrypt && !strncmp(cmdbuf, "-x rcp ", 7))) {
         char *copy;
        struct stat s;
+       int offst = 0;
 
        copy = malloc(strlen(cmdbuf) + 1);
        if (copy == NULL) {
@@ -1321,14 +1316,14 @@ envinit[i] =buf;
        }
        strcpy(copy, cmdbuf);
        if (do_encrypt && !strncmp(cmdbuf, "-x ", 3)) {
-           strcpy(cmdbuf + 3, kprogdir);
-           cp = copy + 6;
-       } else {
-           strcpy(cmdbuf, kprogdir);
-           cp = copy + 3;
+               offst = 3;
        }
+
+        strcpy((char *) cmdbuf + offst, kprogdir);
+       cp = copy + 3 + offst;
+
        strcat(cmdbuf, "/rcp");
-       if (stat(cmdbuf, &s) >= 0)
+       if (stat((char *)cmdbuf + offst, &s) >= 0)
          strcat(cmdbuf, cp);
        else
          strcpy(cmdbuf, copy);
@@ -1336,12 +1331,18 @@ envinit[i] =buf;
     }
 #endif
 
+    cp = strrchr(pwd->pw_shell, '/');
+    if (cp)
+      cp++;
+    else
+      cp = pwd->pw_shell;
+    
     if (do_encrypt && !strncmp(cmdbuf, "-x ", 3)) {
        execl(pwd->pw_shell, cp, "-c", (char *)cmdbuf + 3, 0);
     }
-    else
+    else {
        execl(pwd->pw_shell, cp, "-c", cmdbuf, 0);
-
+}
     perror(pwd->pw_shell);
     perror(cp);
     exit(1);