From 61470612e3bc1a0aca268d80bc55c36c1802b7fd Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Wed, 20 Jan 2021 09:04:39 +0100 Subject: [PATCH 5/5] Don't assume that argv is allocated as a single flat buffer. While this is how the kernel behaves it is not a portable assumption. The assumption may also be violated if getopt_long(3) permutes arguments. Found by Qualys. [Salvatore Bonaccorso: Backport to 1.8.27: Context changes] --- src/parse_args.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/src/parse_args.c +++ b/src/parse_args.c @@ -563,16 +563,16 @@ parse_args(int argc, char **argv, int *n if (argc != 0) { /* shell -c "command" */ char *src, *dst; - size_t cmnd_size = (size_t) (argv[argc - 1] - argv[0]) + - strlen(argv[argc - 1]) + 1; + size_t size = 0; - cmnd = dst = reallocarray(NULL, cmnd_size, 2); - if (cmnd == NULL) + for (av = argv; *av != NULL; av++) + size += strlen(*av) + 1; + if (size == 0 || (cmnd = reallocarray(NULL, size, 2)) == NULL) sudo_fatalx(U_("%s: %s"), __func__, U_("unable to allocate memory")); if (!gc_add(GC_PTR, cmnd)) exit(1); - for (av = argv; *av != NULL; av++) { + for (dst = cmnd, av = argv; *av != NULL; av++) { for (src = *av; *src != '\0'; src++) { /* quote potential meta characters */ if (!isalnum((unsigned char)*src) && *src != '_' && *src != '-' && *src != '$')