Fix the bug which allowed people to avoid the "-s" (secure) bug.

Now, "finger" is invoked with "--" before the first network supplied
argument, so the "--" and "-l" hacks will be stopped.

1 files changed, 3 insertions, 2 deletions

diff --git a/libexec/fingerd/fingerd.c b/libexec/fingerd/fingerd.c
index 7f88bf4..cbba164 100644
--- a/libexec/fingerd/fingerd.c
+++ b/libexec/fingerd/fingerd.c
@@ -107,10 +107,11 @@ main(argc, argv)
 		exit(1);
 
 	comp = &av[1];
-	for (lp = line, ap = &av[2];;) {
+	av[2] = "--";
+	for (lp = line, ap = &av[3];;) {
 		*ap = strtok(lp, " \t\r\n");
 		if (!*ap) {
-			if (secure && ap == &av[2]) {
+			if (secure && ap == &av[3]) {
 				puts("must provide username\r\n");
 				exit(1);
 			}