On Sun, Nov 06, 2022 at 07:07:06AM -0700, Todd C. Miller wrote:
> On Sun, 06 Nov 2022 10:44:10 +0000, Matthieu Herrb wrote:
> 
> > Thanks for the report. You're right that this was overlooked when I
> > wrote this code.
> >
> > I'd suggest the more complete (and paranoid) patch below:
> 
> I don't think you can set client->clientIds->cmdname to a constant
> string such as "" since it is freed later.  I think you want:
> 
>     *cmdname = strdup("");

Yes you're right. In fact I was just looking at why my X server was
now abort()ing on exit while testing this :-)

New patch, that also fixes white space according to X.Org coding
rules.

Index: os/client.c
===================================================================
RCS file: /cvs/OpenBSD/xenocara/xserver/os/client.c,v
retrieving revision 1.5
diff -u -p -u -r1.5 client.c
--- os/client.c 11 Nov 2021 09:03:14 -0000      1.5
+++ os/client.c 6 Nov 2022 15:08:27 -0000
@@ -160,18 +160,26 @@ DetermineClientCmd(pid_t pid, const char
         if (n != 1)
             return;
         argv = kvm_getargv(kd, kp, 0);
-        *cmdname = strdup(argv[0]);
-        i = 1;
-        while (argv[i] != NULL) {
-            len += strlen(argv[i]) + 1;
-            i++;
+        if (cmdname) {
+            if (argv == NULL || argv[0] == NULL) {
+                *cmdname = strdup("");
+                return;
+            } else
+                *cmdname = strdup(argv[0]);
         }
-        *cmdargs = calloc(1, len);
-        i = 1;
-        while (argv[i] != NULL) {
-            strlcat(*cmdargs, argv[i], len);
-            strlcat(*cmdargs, " ", len);
-            i++;
+        if (cmdargs) {
+            i = 1;
+            while (argv[i] != NULL) {
+                len += strlen(argv[i]) + 1;
+                i++;
+            }
+            *cmdargs = calloc(1, len);
+            i = 1;
+            while (argv[i] != NULL) {
+                strlcat(*(char **)cmdargs, argv[i], len);
+                strlcat(*(char **)cmdargs, " ", len);
+                i++;
+            }
         }
         kvm_close(kd);
     }

-- 
Matthieu Herrb

Reply via email to