Make sure that do_cmd() doesn't overflow its arg-pointer array

[rsync/rsync.git] / main.c

diff --git a/main.c b/main.c
index 9aceed2..fbc5030 100644 (file)
--- a/main.c
+++ b/main.c
@@ -219,7 +219,7 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
                    int *f_in, int *f_out)
 {
        int i, argc = 0;
-       char *args[100];
+       char *args[MAX_ARGS];
        pid_t ret;
        char *tok, *dir = NULL;
        int dash_l_set = 0;
@@ -234,8 +234,13 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
                if (!cmd)
                        goto oom;
 
-               for (tok = strtok(cmd, " "); tok; tok = strtok(NULL, " "))
+               for (tok = strtok(cmd, " "); tok; tok = strtok(NULL, " ")) {
+                       if (argc >= MAX_ARGS) {
+                               rprintf(FERROR, "Command is too long\n");
+                               exit_cleanup(RERR_SYNTAX);
+                       }
                        args[argc++] = tok;
+               }
 
                /* check to see if we've already been given '-l user' in
                 * the remote-shell command */
@@ -301,7 +306,8 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
                ret = piped_child(args,f_in,f_out);
        }
 
-       if (dir) free(dir);
+       if (dir)
+               free(dir);
 
        return ret;
 
@@ -443,7 +449,8 @@ static int do_recv(int f_in,int f_out,struct file_list *flist,char *local_name)
 
        if ((pid=do_fork()) == 0) {
                close(error_pipe[0]);
-               if (f_in != f_out) close(f_out);
+               if (f_in != f_out)
+                       close(f_out);
 
                /* we can't let two processes write to the socket at one time */
                io_multiplexing_close();
@@ -467,7 +474,8 @@ static int do_recv(int f_in,int f_out,struct file_list *flist,char *local_name)
        am_generator = 1;
 
        close(error_pipe[1]);
-       if (f_in != f_out) close(f_in);
+       if (f_in != f_out)
+               close(f_in);
 
        io_start_buffering_out(f_out);
 
@@ -546,7 +554,8 @@ static void do_server_recv(int f_in, int f_out, int argc,char *argv[])
        if (argc > 0) {
                if (strcmp(dir,".")) {
                        argv[0] += strlen(dir);
-                       if (argv[0][0] == '/') argv[0]++;
+                       if (argv[0][0] == '/')
+                               argv[0]++;
                }
                local_name = get_local_name(flist,argv[0]);
        }