Make sure that the generator sent us a valid index into basis_dir[].

diff --git a/receiver.c b/receiver.c
index 8c91ea6..3e72768 100644 (file)
--- a/receiver.c
+++ b/receiver.c
@@ -40,6 +40,7 @@ extern int io_error;
 extern char *tmpdir;
 extern char *partial_dir;
 extern char *basis_dir[];
+extern int basis_dir_cnt;
 extern int make_backups;
 extern int do_progress;
 extern char *backup_dir;
@@ -453,8 +454,13 @@ int recv_files(int f_in, struct file_list *flist, char *local_name,
                        case FNAMECMP_BACKUP:
                                fnamecmp = get_backup_name(fname);
                                break;
-                       case FNAMECMP_BASIS_DIR:
                        default:
+                               if (j >= basis_dir_cnt) {
+                                       rprintf(FERROR,
+                                               "invalid basis_dir index: %d.\n",
+                                               j);
+                                       exit_cleanup(RERR_PROTOCOL);
+                               }
                                pathjoin(fnamecmpbuf, sizeof fnamecmpbuf,
                                         basis_dir[j], fname);
                                fnamecmp = fnamecmpbuf;