Prevent overflowing the buffer that stores the command arguments.

PR:		bin/19422
Not objected to by: -audit
MFC after:	3 weeks

1 files changed, 8 insertions, 4 deletions

diff --git a/bin/ps/fmt.c b/bin/ps/fmt.c
index 9c0f8d3..ff29af6 100644
--- a/bin/ps/fmt.c
+++ b/bin/ps/fmt.c
@@ -61,7 +61,8 @@ static char *
 shquote(argv)
 	char **argv;
 {
-	long arg_max;
+	static long arg_max = -1;
+	long len;
 	char **p, *dst, *src;
 	static char *buf = NULL;
 
@@ -80,13 +81,16 @@ shquote(argv)
 	for (p = argv; (src = *p++) != 0; ) {
 		if (*src == 0)
 			continue;
-		strvis(dst, src, VIS_NL | VIS_CSTYLE);
+		len = (4 * arg_max - (dst - buf)) / 4;
+		strvisx(dst, src, strlen(src) < len ? strlen(src) : len,
+		    VIS_NL | VIS_CSTYLE);
 		while (*dst)
 			dst++;
-		*dst++ = ' ';
+		if ((4 * arg_max - (dst - buf)) / 4 > 0)
+			*dst++ = ' ';
 	}
 	/* Chop off trailing space */
-	if (dst != buf)
+	if (dst != buf && dst[-1] == ' ')
 		dst--;
 	*dst = '\0';
 	return (buf);