Make sure that do_cmd() doesn't overflow its arg-pointer array

[rsync/rsync.git] / main.c

diff --git a/main.c b/main.c
index 3819274..fbc5030 100644 (file)
--- a/main.c
+++ b/main.c
@@ -219,7 +219,7 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
                    int *f_in, int *f_out)
 {
        int i, argc = 0;
-       char *args[100];
+       char *args[MAX_ARGS];
        pid_t ret;
        char *tok, *dir = NULL;
        int dash_l_set = 0;
@@ -234,8 +234,13 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
                if (!cmd)
                        goto oom;
 
-               for (tok = strtok(cmd, " "); tok; tok = strtok(NULL, " "))
+               for (tok = strtok(cmd, " "); tok; tok = strtok(NULL, " ")) {
+                       if (argc >= MAX_ARGS) {
+                               rprintf(FERROR, "Command is too long\n");
+                               exit_cleanup(RERR_SYNTAX);
+                       }
                        args[argc++] = tok;
+               }
 
                /* check to see if we've already been given '-l user' in
                 * the remote-shell command */
@@ -301,7 +306,8 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
                ret = piped_child(args,f_in,f_out);
        }
 
-       if (dir) free(dir);
+       if (dir)
+               free(dir);
 
        return ret;
 
@@ -443,7 +449,8 @@ static int do_recv(int f_in,int f_out,struct file_list *flist,char *local_name)
 
        if ((pid=do_fork()) == 0) {
                close(error_pipe[0]);
-               if (f_in != f_out) close(f_out);
+               if (f_in != f_out)
+                       close(f_out);
 
                /* we can't let two processes write to the socket at one time */
                io_multiplexing_close();
@@ -467,7 +474,8 @@ static int do_recv(int f_in,int f_out,struct file_list *flist,char *local_name)
        am_generator = 1;
 
        close(error_pipe[1]);
-       if (f_in != f_out) close(f_in);
+       if (f_in != f_out)
+               close(f_in);
 
        io_start_buffering_out(f_out);
 
@@ -546,7 +554,8 @@ static void do_server_recv(int f_in, int f_out, int argc,char *argv[])
        if (argc > 0) {
                if (strcmp(dir,".")) {
                        argv[0] += strlen(dir);
-                       if (argv[0][0] == '/') argv[0]++;
+                       if (argv[0][0] == '/')
+                               argv[0]++;
                }
                local_name = get_local_name(flist,argv[0]);
        }
@@ -735,9 +744,9 @@ static int start_client(int argc, char *argv[])
                return start_socket_client(host, path, argc-1, argv+1);
        }
 
-       if (!read_batch) {
+       if (!read_batch) { /* for read_batch, NO source is specified */
                p = find_colon(argv[0]);
-               if (p) {
+               if (p) { /* source is remote */
                        if (remote_filesfrom_file
                         && remote_filesfrom_file != files_from + 1
                         && strncmp(files_from, argv[0], p-argv[0]+1) != 0) {
@@ -755,7 +764,7 @@ static int start_client(int argc, char *argv[])
                                daemon_over_rsh = 1;
                        }
 
-                       if (argc < 1) {
+                       if (argc < 1) { /* destination required */
                                usage(FERROR);
                                exit_cleanup(RERR_SYNTAX);
                        }
@@ -764,9 +773,8 @@ static int start_client(int argc, char *argv[])
                        *p = 0;
                        shell_machine = argv[0];
                        shell_path = p+1;
-                       argc--;
                        argv++;
-               } else {
+               } else { /* source is local */
                        am_sender = 1;
 
                        /* rsync:// destination uses rsync server over direct socket */
@@ -789,7 +797,7 @@ static int start_client(int argc, char *argv[])
                                return start_socket_client(host, path, argc-1, argv);
                        }
 
-                       p = find_colon(argv[argc-1]);
+                       p = find_colon(argv[argc-1]); /* look in dest arg */
                        if (p && remote_filesfrom_file
                         && remote_filesfrom_file != files_from + 1
                         && strncmp(files_from, argv[argc-1], p-argv[argc-1]+1) != 0) {
@@ -797,7 +805,7 @@ static int start_client(int argc, char *argv[])
                                        "--files-from hostname is not transfer hostname\n");
                                exit_cleanup(RERR_SYNTAX);
                        }
-                       if (!p) {
+                       if (!p) { /* no colon found, so src & dest are local */
                                local_server = 1;
                                if (remote_filesfrom_file) {
                                        rprintf(FERROR,
@@ -827,9 +835,9 @@ static int start_client(int argc, char *argv[])
                                shell_machine = argv[argc-1];
                                shell_path = p+1;
                        }
-                       argc--;
                }
-       } else {
+               argc--;
+       } else {  /* read_batch */
                am_sender = 1;
                local_server = 1;
                shell_path = argv[argc-1];
@@ -852,12 +860,14 @@ static int start_client(int argc, char *argv[])
                        shell_path?shell_path:"");
        }
 
+       /* for remote source, only single dest arg can remain ... */
        if (!am_sender && argc > 1) {
                usage(FERROR);
                exit_cleanup(RERR_SYNTAX);
        }
 
-       if (argc == 0 && !am_sender) {
+       /* ... or no dest at all */
+       if (!am_sender && argc == 0) {
                list_only = 1;
        }