Removed potential buffer overflow in ali.c by replacing array of

[mmh] / uip / ali.c

diff --git a/uip/ali.c b/uip/ali.c
index a8812c2..e9a63fd 100644 (file)
--- a/uip/ali.c
+++ b/uip/ali.c
@@ -2,8 +2,6 @@
 /*
  * ali.c -- list nmh mail aliases
  *
- * $Id$
- *
  * This code is Copyright (c) 2002, by the authors of nmh.  See the
  * COPYRIGHT file in the root directory of the nmh distribution for
  * complete copyright information.
@@ -15,11 +13,6 @@
 #include <h/mts.h>
 #include <h/utils.h>
 
-/*
- * maximum number of names
- */
-#define        NVEC 50
-
 static struct swit switches[] = {
 #define        ALIASW                0
     { "alias aliasfile", 0 },
@@ -61,7 +54,9 @@ main (int argc, char **argv)
     int i, vecp = 0, inverted = 0, list = 0;
     int noalias = 0, normalize = AD_NHST;
     char *cp, **ap, **argp, buf[BUFSIZ];
-    char *vec[NVEC], **arguments;
+    /* Really only need to allocate for argc-1, but must allocate at least 1,
+       so go ahead and allocate for argc char pointers. */
+    char **vec = mh_xmalloc (argc * sizeof (char *)), **arguments;
     struct aka *ak;
 
 #ifdef LOCALE
@@ -89,10 +84,10 @@ main (int argc, char **argv)
                    snprintf (buf, sizeof(buf), "%s [switches] aliases ...",
                        invo_name);
                    print_help (buf, switches, 1);
-                   done (1);
+                   done (0);
                case VERSIONSW:
                    print_version (invo_name);
-                   done (1);
+                   done (0);
 
                case ALIASW: 
                    if (!(cp = *argp++) || *cp == '-')
@@ -126,7 +121,14 @@ main (int argc, char **argv)
                    continue;
            }
        }
-       vec[vecp++] = cp;
+
+       if (vecp < argc) {
+           vec[vecp++] = cp;
+       } else {
+           /* Should never happen, but try to protect against code changes
+              that could allow it. */
+           adios (NULL, "too many arguments");
+       }
     }
 
     if (!noalias) {
@@ -153,24 +155,24 @@ main (int argc, char **argv)
 
        for (i = 0; i < vecp; i++)
            print_usr (vec[i], list, normalize);
-
-       done (0);
-    }
-
-    if (vecp) {
-       /* print specified aliases */
-       for (i = 0; i < vecp; i++)
-           print_aka (akvalue (vec[i]), list, 0);
     } else {
-       /* print them all */
-       for (ak = akahead; ak; ak = ak->ak_next) {
-           printf ("%s: ", ak->ak_name);
-           pos += strlen (ak->ak_name) + 1;
-           print_aka (akresult (ak), list, pos);
+       if (vecp) {
+           /* print specified aliases */
+           for (i = 0; i < vecp; i++)
+               print_aka (akvalue (vec[i]), list, 0);
+       } else {
+           /* print them all */
+           for (ak = akahead; ak; ak = ak->ak_next) {
+               printf ("%s: ", ak->ak_name);
+               pos += strlen (ak->ak_name) + 1;
+               print_aka (akresult (ak), list, pos);
+           }
        }
     }
 
-    return done (0);
+    free (vec);
+    done (0);
+    return 1;
 }
 
 static void