Attachment #3585 for bug #3403

View | Details | Raw Unified | Return to bug 3403
Collapse All | Expand All




	r = vasprintf(&cp, fmt, ap);
	va_end(ap);
	if (r == -1)
		fatal_f("argument too long");

	nalloc = args->nalloc;
	if (args->list == NULL) {
		nalloc = 32;
		args->num = 0;
	} else if (args->num > (256 * 1024))
		fatal_f("too many arguments");
	else if (args->num >= args->nalloc)
		fatal_f("arglist corrupt");
	else if (args->num+2 >= nalloc)
		nalloc *= 2;

	args->list = xrecallocarray(args->list, args->nalloc,
	    nalloc, sizeof(char *));
	args->nalloc = nalloc;
	args->list[args->num++] = cp;
	args->list[args->num] = NULL;

	r = vasprintf(&cp, fmt, ap);
	va_end(ap);
	if (r == -1)
		fatal_f("argument too long");
	if (args->list == NULL || args->num >= args->nalloc)
		fatal_f("arglist corrupt");

	if (which >= args->num)
		fatal_f("tried to replace invalid arg %d >= %d",
		    which, args->num);
	free(args->list[which]);
	args->list[which] = cp;

{
	u_int i;

	if (args == NULL)
		return;
	if (args->list != NULL && args->num < args->nalloc) {
		for (i = 0; i < args->num; i++)
			free(args->list[i]);
		free(args->list);
		args->nalloc = args->num = 0;
		args->list = NULL;
	}
	args->nalloc = args->num = 0;
	args->list = NULL;
}

/*

Lines 935-941 do_sftp_connect(char host, char user, int port, char *sftp_direct, Link Here

(-)a/scp.c (-1 / +1 lines)
935	return NULL;	935	return NULL;
936		936
937	} else {	937	} else {
938	args.list = NULL;	938	freeargs(&args);
939	addargs(&args, "sftp-server");	939	addargs(&args, "sftp-server");
940	if (do_cmd(sftp_direct, host, NULL, -1, 0, "sftp",	940	if (do_cmd(sftp_direct, host, NULL, -1, 0, "sftp",
941	reminp, remoutp, pidp) < 0)	941	reminp, remoutp, pidp) < 0)

Return to bug 3403

Lines 1022-1037 addargs(arglist args, char fmt, ...) Link Here

(-)a/misc.c (-8 / +17 lines)
1022	r = vasprintf(&cp, fmt, ap);	1022	r = vasprintf(&cp, fmt, ap);
1023	va_end(ap);	1023	va_end(ap);
1024	if (r == -1)	1024	if (r == -1)
1025	fatal("addargs: argument too long");	1025	fatal_f("argument too long");
1026		1026
1027	nalloc = args->nalloc;	1027	nalloc = args->nalloc;
1028	if (args->list == NULL) {	1028	if (args->list == NULL) {
1029	nalloc = 32;	1029	nalloc = 32;
1030	args->num = 0;	1030	args->num = 0;
1031	} else if (args->num+2 >= nalloc)	1031	} else if (args->num > (256 * 1024))
		1032	fatal_f("too many arguments");
		1033	else if (args->num >= args->nalloc)
		1034	fatal_f("arglist corrupt");
		1035	else if (args->num+2 >= nalloc)
1032	nalloc *= 2;	1036	nalloc *= 2;
1033		1037
1034	args->list = xrecallocarray(args->list, args->nalloc, nalloc, sizeof(char *));	1038	args->list = xrecallocarray(args->list, args->nalloc,
		1039	nalloc, sizeof(char *));
1035	args->nalloc = nalloc;	1040	args->nalloc = nalloc;
1036	args->list[args->num++] = cp;	1041	args->list[args->num++] = cp;
1037	args->list[args->num] = NULL;	1042	args->list[args->num] = NULL;
Lines 1048-1057 replacearg(arglist args, u_int which, char fmt, ...) Link Here
1048	r = vasprintf(&cp, fmt, ap);	1053	r = vasprintf(&cp, fmt, ap);
1049	va_end(ap);	1054	va_end(ap);
1050	if (r == -1)	1055	if (r == -1)
1051	fatal("replacearg: argument too long");	1056	fatal_f("argument too long");
		1057	if (args->list == NULL \|\| args->num >= args->nalloc)
		1058	fatal_f("arglist corrupt");
1052		1059
1053	if (which >= args->num)	1060	if (which >= args->num)
1054	fatal("replacearg: tried to replace invalid arg %d >= %d",	1061	fatal_f("tried to replace invalid arg %d >= %d",
1055	which, args->num);	1062	which, args->num);
1056	free(args->list[which]);	1063	free(args->list[which]);
1057	args->list[which] = cp;	1064	args->list[which] = cp;
Lines 1062-1074 freeargs(arglist *args) Link Here
1062	{	1069	{
1063	u_int i;	1070	u_int i;
1064		1071
1065	if (args->list != NULL) {	1072	if (args == NULL)
		1073	return;
		1074	if (args->list != NULL && args->num < args->nalloc) {
1066	for (i = 0; i < args->num; i++)	1075	for (i = 0; i < args->num; i++)
1067	free(args->list[i]);	1076	free(args->list[i]);
1068	free(args->list);	1077	free(args->list);
1069	args->nalloc = args->num = 0;
1070	args->list = NULL;
1071	}	1078	}
		1079	args->nalloc = args->num = 0;
		1080	args->list = NULL;
1072	}	1081	}
1073		1082
1074	/*	1083	/*