diff options
| author | Russ Allbery <rra@stanford.edu> | 2012-05-10 16:54:21 -0700 |
|---|---|---|
| committer | Russ Allbery <rra@stanford.edu> | 2012-05-10 16:54:21 -0700 |
| commit | 36544e0bd9645821cee56f89aa369bb1490bda9a (patch) | |
| tree | 4b357103bf2777fada6758c5276e06ff87bb53f2 /server | |
| parent | 2a04597a2f761c480f5fb7e69e32be8696b6e60a (diff) | |
Fix a couple of memory allocation bugs with summary support
We were checking past the end of the argv array when there was no
subcommand, and allocating one too few pointers for the summary
argv.
Change-Id: If4cf91fa7db6390857e1db64437f7da16204bd0b
Diffstat (limited to 'server')
| -rw-r--r-- | server/commands.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/server/commands.c b/server/commands.c index 6676cac..043c615 100644 --- a/server/commands.c +++ b/server/commands.c @@ -536,7 +536,7 @@ server_send_summary(struct client *client, const char *user, * argv and pass off to be executed. */ path = cline->program; - req_argv = xmalloc(2 * sizeof(char *)); + req_argv = xmalloc(3 * sizeof(char *)); program = strrchr(path, '/'); if (program == NULL) program = path; @@ -728,7 +728,7 @@ server_run_command(struct client *client, struct config *config, if (cline == NULL && strcmp(command, "help") == 0) { /* Error if we have more than a command and possible subcommand. */ - if (argv[2] != NULL && argv[3] != NULL) { + if (argv[1] != NULL && argv[2] != NULL && argv[3] != NULL) { notice("help command from user %s has more than three arguments", user); server_send_error(client, ERROR_TOOMANY_ARGS, |