From: Mark Wooding <mdw@distorted.org.uk>
Date: Mon, 8 Dec 2008 20:14:24 +0000 (+0000)
Subject: server/admin: Brown-paper-bag fix.
X-Git-Tag: 1.0.0pre8~49
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~mdw/git/tripe/commitdiff_plain/6f88042a4307bec23ed4d451f320b46c9ec7602f?ds=sidebyside

server/admin: Brown-paper-bag fix.

Commit 165efde7 changed a_resolve to not require a port number.
Unfortunately, I botched it and wrote a test for av[i + 1] as
av[i + i].  Result with i = 0: very different.

While investigating this bug, I became nervous about the number of
is-av[i]-null tests going on when str_qsplit doesn't actually guarantee
to leave a null terminator behind if it uses all the array slots.  So
I've allocated an extra slot and zeroed it explicitly.
---

diff --git a/server/admin.c b/server/admin.c
index 382baca9..1a4d2a45 100644
--- a/server/admin.c
+++ b/server/admin.c
@@ -1062,7 +1062,7 @@ static void a_resolve(admin *a, admin_resop *r, const char *tag,
   r->sa.sin.sin_family = AF_INET;
   r->sasz = sizeof(r->sa.sin);
   r->addr = xstrdup(av[i]);
-  if (!av[i + i])
+  if (!av[i + 1])
     pt = TRIPE_PORT;
   else {
     pt = strtoul(av[i + 1], &p, 0);
@@ -2025,7 +2025,7 @@ static void a_line(char *p, size_t len, void *vp)
 {
   admin *a = vp;
   const acmd *c;
-  char *av[16];
+  char *av[16 + 1];
   size_t ac;
 
   TIMER;
@@ -2040,9 +2040,10 @@ static void a_line(char *p, size_t len, void *vp)
     }
     return;
   }
-  ac = str_qsplit(p, av, 16, 0, STRF_QUOTE);
+  ac = str_qsplit(p, av, N(av) - 1, 0, STRF_QUOTE);
   if (!ac)
     return;
+  av[ac] = 0;
   for (c = acmdtab; c->name; c++) {
     if (mystrieq(av[0], c->name)) {
       ac--;