# [PATCH] rsh.c unterminated string

1 messages from 2005-09-23 to 2005-09-23. Participants: H. Peter Anvin.
Thread: https://gitlist.dev/t/1930

## H. Peter Anvin, 2005-09-23 23:30

Subject: [PATCH] rsh.c unterminated string
Message-ID: <4334902A.3010905@zytor.com>
URL: https://gitlist.dev/e/4334902A.3010905%40zytor.com

```
The change I made to rsh.c would leave the string unterminated under 
certain conditions, which unfortunately always applied!  This patch 
fixes this.  For some reason this never bit on i386 or ppc, but bit me 
on x86-64.

Signed-off-by: H. Peter Anvin <hpa@zytor.com>


Fix situation where the buffer was not properly null-terminated.

---
commit 62f7819792e7152ae0dc241ed2f7e05e10c0d345
tree 865683d54a0c4d7604711d6b74233f79291eb8ac
parent acfadcfb48e34fdc441e9cffbb385fce9693b363
author Peter Anvin <hpa@tazenda.sc.orionmulti.com> Fri, 23 Sep 2005 16:22:33 -0700
committer Peter Anvin <hpa@tazenda.sc.orionmulti.com> Fri, 23 Sep 2005 16:22:33 -0700

 rsh.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/rsh.c b/rsh.c
--- a/rsh.c
+++ b/rsh.c
@@ -53,6 +53,7 @@ static int add_to_string(char **ptrp, in
 	char *p = *ptrp;
 	int size = *sizep;
 	int oc;
+	int err = 0;
 
 	if ( quote ) {
 		oc = shell_quote(p, size, str);
@@ -62,15 +63,14 @@ static int add_to_string(char **ptrp, in
 	}
 
 	if ( oc >= size ) {
-		p[size-1] = '\0';
-		*ptrp += size-1;
-		*sizep = 1;
-		return 1;	/* Overflow, string unusable */
+		err = 1;
+		oc = size-1;
 	}
 
 	*ptrp  += oc;
+	**ptrp  = '\0';
 	*sizep -= oc;
-	return 0;
+	return err;
 }
 
 int setup_connection(int *fd_in, int *fd_out, const char *remote_prog, 

```