last_patch55 from vodz:

    I found overflow problem in xargs applet
    (allocated not space for trailing '\0').
    Last patch also reduce 22 bytes size. ;)

1 files changed, 20 insertions, 18 deletions

diff --git a/findutils/xargs.c b/findutils/xargs.c
index bb5987ec9..471bae45b 100644
--- a/findutils/xargs.c
+++ b/findutils/xargs.c
@@ -28,8 +28,10 @@
 
 int xargs_main(int argc, char **argv)
 {
-        char *cmd_to_be_executed = NULL;
-        char *file_to_act_on = NULL;
+        char *cmd_to_be_executed;
+        char *file_to_act_on;
+        int i;
+        int len;
 
         /*
          * No options are supported in this version of xargs; no getopt.
@@ -42,41 +44,41 @@ int xargs_main(int argc, char **argv)
          * once with no args and xargs will echo the filename. Simple.
          */
 
+        argv++;
+        len = argc;     /* arg = count for ' ' + trailing '\0' */
         /* Store the command to be executed (taken from the command line) */
         if (argc == 1) {
                 /* default behavior is to echo all the filenames */
-                cmd_to_be_executed = xstrdup("/bin/echo ");
+                argv[0] = "/bin/echo";
+                len++;  /* space for trailing '\0' */
         } else {
-                /* concatenate all the arguments passed to xargs together */
-                int i;
-                int len = 0;
-                for (i = 1; i < argc; i++) 
-                        len += ( strlen(argv[i]) + 1 );
-                cmd_to_be_executed = xstrndup ( "", len );      
-                for (i = 1; i < argc; i++) {
-                        strcat(cmd_to_be_executed, argv[i]);
-                        strcat(cmd_to_be_executed, " ");
+                argc--;
                 }
+        /* concatenate all the arguments passed to xargs together */
+        for (i = 0; i < argc; i++)
+                len += strlen(argv[i]);
+        cmd_to_be_executed = xmalloc (len);
+        for (i = len = 0; i < argc; i++) {
+                len = sprintf(cmd_to_be_executed + len, "%s ", argv[i]);
         }
 
         /* Now, read in one line at a time from stdin, and store this 
          * line to be used later as an argument to the command */
         while ((file_to_act_on = get_line_from_file(stdin)) !=NULL) {
 
-                FILE *cmd_output = NULL;
-                char *output_line = NULL;
-                char *execstr = NULL;
+                FILE *cmd_output;
+                char *output_line;
+                char *execstr;
 
                 /* eat the newline off the filename. */
                 chomp(file_to_act_on);
 
                 /* eat blank lines */
-                if (strlen(file_to_act_on) == 0)
+                if (file_to_act_on[0] == 0)
                         continue;
 
                 /* assemble the command and execute it */
-                execstr = xstrndup ( cmd_to_be_executed, xstrlen(cmd_to_be_executed) + xstrlen(file_to_act_on));
-                strcat(execstr, file_to_act_on);
+                bb_asprintf(&execstr, "%s%s", cmd_to_be_executed, file_to_act_on);
                 
                 cmd_output = popen(execstr, "r");
                 if (cmd_output == NULL)