X-Git-Url: https://mattmccutchen.net/rsync/rsync.git/blobdiff_plain/d16c245fc4094d79d13b77ae6a5153836407cd89..e1f67417d7af01cc51dc4391d2bc7228ca42f73a:/main.c

diff --git a/main.c b/main.c
index 9aceed27..75070e3c 100644
--- a/main.c
+++ b/main.c
@@ -219,7 +219,7 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
 		    int *f_in, int *f_out)
 {
 	int i, argc = 0;
-	char *args[100];
+	char *args[MAX_ARGS];
 	pid_t ret;
 	char *tok, *dir = NULL;
 	int dash_l_set = 0;
@@ -234,8 +234,14 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
 		if (!cmd)
 			goto oom;
 
-		for (tok = strtok(cmd, " "); tok; tok = strtok(NULL, " "))
+		for (tok = strtok(cmd, " "); tok; tok = strtok(NULL, " ")) {
+			/* Comparison leaves rooms for server_options(). */
+			if (argc >= MAX_ARGS - 100) {
+				rprintf(FERROR, "internal: args[] overflowed in do_cmd()\n");
+				exit_cleanup(RERR_SYNTAX);
+			}
 			args[argc++] = tok;
+		}
 
 		/* check to see if we've already been given '-l user' in
 		 * the remote-shell command */
@@ -272,6 +278,11 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
 		}
 
 		server_options(args,&argc);
+
+		if (argc >= MAX_ARGS - 2) {
+			rprintf(FERROR, "internal: args[] overflowed in do_cmd()\n");
+			exit_cleanup(RERR_SYNTAX);
+		}
 	}
 
 	args[argc++] = ".";
@@ -279,16 +290,11 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
 	if (!daemon_over_rsh && path && *path)
 		args[argc++] = path;
 
-	if (argc >= (int)(sizeof args / sizeof args[0])) {
-		rprintf(FERROR, "internal: args[] overflowed in do_cmd()\n");
-		exit_cleanup(RERR_MALLOC); /* XXX Need better RERR? */
-	}
-
 	args[argc] = NULL;
 
 	if (verbose > 3) {
 		rprintf(FINFO,"cmd=");
-		for (i=0;i<argc;i++)
+		for (i = 0; i < argc; i++)
 			rprintf(FINFO,"%s ",args[i]);
 		rprintf(FINFO,"\n");
 	}
@@ -301,7 +307,8 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char *path,
 		ret = piped_child(args,f_in,f_out);
 	}
 
-	if (dir) free(dir);
+	if (dir)
+		free(dir);
 
 	return ret;
 
@@ -389,12 +396,12 @@ static void do_server_sender(int f_in, int f_out, int argc,char *argv[])
 		int l = strlen(dir);
 		if (strcmp(dir,"/") == 0)
 			l = 0;
-		for (i=0;i<argc;i++)
+		for (i = 0; i < argc; i++)
 			argv[i] += l+1;
 	}
 
 	if (argc == 0 && recurse) {
-		argc=1;
+		argc = 1;
 		argv--;
 		argv[0] = ".";
 	}
@@ -421,7 +428,7 @@ static void do_server_sender(int f_in, int f_out, int argc,char *argv[])
 static int do_recv(int f_in,int f_out,struct file_list *flist,char *local_name)
 {
 	int pid;
-	int status=0;
+	int status = 0;
 	int error_pipe[2];
 
 	if (preserve_hard_links)
@@ -441,9 +448,10 @@ static int do_recv(int f_in,int f_out,struct file_list *flist,char *local_name)
 
 	io_flush(NORMAL_FLUSH);
 
-	if ((pid=do_fork()) == 0) {
+	if ((pid = do_fork()) == 0) {
 		close(error_pipe[0]);
-		if (f_in != f_out) close(f_out);
+		if (f_in != f_out)
+			close(f_out);
 
 		/* we can't let two processes write to the socket at one time */
 		io_multiplexing_close();
@@ -467,7 +475,8 @@ static int do_recv(int f_in,int f_out,struct file_list *flist,char *local_name)
 	am_generator = 1;
 
 	close(error_pipe[1]);
-	if (f_in != f_out) close(f_in);
+	if (f_in != f_out)
+		close(f_in);
 
 	io_start_buffering_out(f_out);
 
@@ -546,7 +555,8 @@ static void do_server_recv(int f_in, int f_out, int argc,char *argv[])
 	if (argc > 0) {
 		if (strcmp(dir,".")) {
 			argv[0] += strlen(dir);
-			if (argv[0][0] == '/') argv[0]++;
+			if (argv[0][0] == '/')
+				argv[0]++;
 		}
 		local_name = get_local_name(flist,argv[0]);
 	}