last_patch55 from vodz:

    I found overflow problem in xargs applet
    (allocated not space for trailing '\0').
    Last patch also reduce 22 bytes size. ;)

1 files changed, 20 insertions, 18 deletions

diff --git a/findutils/xargs.c b/findutils/xargs.c
index bb5987ec9..471bae45b 100644
--- a/findutils/xargs.c
+++ b/findutils/xargs.c
@@ -28,8 +28,10 @@
 
 int xargs_main(int argc, char **argv)
 {
-	char *cmd_to_be_executed = NULL;
-	char *file_to_act_on = NULL;
+	char *cmd_to_be_executed;
+	char *file_to_act_on;
+	int i;
+	int len;
 
 	/*
 	 * No options are supported in this version of xargs; no getopt.
@@ -42,41 +44,41 @@ int xargs_main(int argc, char **argv)
 	 * once with no args and xargs will echo the filename. Simple.
 	 */
 
+	argv++;
+	len = argc;     /* arg = count for ' ' + trailing '\0' */
 	/* Store the command to be executed (taken from the command line) */
 	if (argc == 1) {
 		/* default behavior is to echo all the filenames */
-		cmd_to_be_executed = xstrdup("/bin/echo ");
+		argv[0] = "/bin/echo";
+		len++;  /* space for trailing '\0' */
 	} else {
-		/* concatenate all the arguments passed to xargs together */
-		int i;
-		int len = 0;
-		for (i = 1; i < argc; i++) 
-			len += ( strlen(argv[i]) + 1 );
-		cmd_to_be_executed = xstrndup ( "", len );	
-		for (i = 1; i < argc; i++) {
-			strcat(cmd_to_be_executed, argv[i]);
-			strcat(cmd_to_be_executed, " ");
+		argc--;
 		}
+	/* concatenate all the arguments passed to xargs together */
+	for (i = 0; i < argc; i++)
+		len += strlen(argv[i]);
+	cmd_to_be_executed = xmalloc (len);
+	for (i = len = 0; i < argc; i++) {
+		len = sprintf(cmd_to_be_executed + len, "%s ", argv[i]);
 	}
 
 	/* Now, read in one line at a time from stdin, and store this 
 	 * line to be used later as an argument to the command */
 	while ((file_to_act_on = get_line_from_file(stdin)) !=NULL) {
 
-		FILE *cmd_output = NULL;
-		char *output_line = NULL;
-		char *execstr = NULL;
+		FILE *cmd_output;
+		char *output_line;
+		char *execstr;
 
 		/* eat the newline off the filename. */
 		chomp(file_to_act_on);
 
 		/* eat blank lines */
-		if (strlen(file_to_act_on) == 0)
+		if (file_to_act_on[0] == 0)
 			continue;
 
 		/* assemble the command and execute it */
-		execstr = xstrndup ( cmd_to_be_executed, xstrlen(cmd_to_be_executed) + xstrlen(file_to_act_on));
-		strcat(execstr, file_to_act_on);
+		bb_asprintf(&execstr, "%s%s", cmd_to_be_executed, file_to_act_on);
 		
 		cmd_output = popen(execstr, "r");
 		if (cmd_output == NULL)