X-Git-Url: https://mattmccutchen.net/rsync/rsync.git/blobdiff_plain/d16c245fc4094d79d13b77ae6a5153836407cd89..887e553f0503e45e5273b5c1d7fa71d5554bc542:/main.c

diff --git a/main.c b/main.c
index 9aceed27..fbc5030b 100644
--- a/main.c
+++ b/main.c
@@ -219,7 +219,7 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
 		    int *f_in, int *f_out)
 {
 	int i, argc = 0;
-	char *args[100];
+	char *args[MAX_ARGS];
 	pid_t ret;
 	char *tok, *dir = NULL;
 	int dash_l_set = 0;
@@ -234,8 +234,13 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
 		if (!cmd)
 			goto oom;
 
-		for (tok = strtok(cmd, " "); tok; tok = strtok(NULL, " "))
+		for (tok = strtok(cmd, " "); tok; tok = strtok(NULL, " ")) {
+			if (argc >= MAX_ARGS) {
+				rprintf(FERROR, "Command is too long\n");
+				exit_cleanup(RERR_SYNTAX);
+			}
 			args[argc++] = tok;
+		}
 
 		/* check to see if we've already been given '-l user' in
 		 * the remote-shell command */
@@ -301,7 +306,8 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
 		ret = piped_child(args,f_in,f_out);
 	}
 
-	if (dir) free(dir);
+	if (dir)
+		free(dir);
 
 	return ret;
 
@@ -443,7 +449,8 @@ static int do_recv(int f_in,int f_out,struct file_list *flist,char *local_name)
 
 	if ((pid=do_fork()) == 0) {
 		close(error_pipe[0]);
-		if (f_in != f_out) close(f_out);
+		if (f_in != f_out)
+			close(f_out);
 
 		/* we can't let two processes write to the socket at one time */
 		io_multiplexing_close();
@@ -467,7 +474,8 @@ static int do_recv(int f_in,int f_out,struct file_list *flist,char *local_name)
 	am_generator = 1;
 
 	close(error_pipe[1]);
-	if (f_in != f_out) close(f_in);
+	if (f_in != f_out)
+		close(f_in);
 
 	io_start_buffering_out(f_out);
 
@@ -546,7 +554,8 @@ static void do_server_recv(int f_in, int f_out, int argc,char *argv[])
 	if (argc > 0) {
 		if (strcmp(dir,".")) {
 			argv[0] += strlen(dir);
-			if (argv[0][0] == '/') argv[0]++;
+			if (argv[0][0] == '/')
+				argv[0]++;
 		}
 		local_name = get_local_name(flist,argv[0]);
 	}