It turns out that set_charset() invokes build_iovec() which modifies

iov address internally through realloc(3).  However, since the function
parameter wasn't designed to allow the modified iov being passed back to
the caller, we end up feeding iov with several corrupted entries(depends on
how many arguments were pushed into iovec before set_charset()) to nmount(2).

This commit fixes this regression introduced in rev1.31 such that
mount_cd9660(8) with code page conversion option(-C) enabled works again.

Reviewed by:	rodrigc

1 files changed, 5 insertions, 5 deletions

diff --git a/sbin/mount_cd9660/mount_cd9660.c b/sbin/mount_cd9660/mount_cd9660.c
index 2c71735..1b198d1 100644
--- a/sbin/mount_cd9660/mount_cd9660.c
+++ b/sbin/mount_cd9660/mount_cd9660.c
@@ -75,7 +75,7 @@ struct mntopt mopts[] = {
 };
 
 static int	get_ssector(const char *dev);
-static int	set_charset(struct iovec *, int *iovlen, const char *);
+static int	set_charset(struct iovec **, int *iovlen, const char *);
 void	usage(void);
 
 int
@@ -128,7 +128,7 @@ main(int argc, char **argv)
 			verbose++;
 			break;
 		case 'C':
-			if (set_charset(iov, &iovlen, optarg) == -1)
+			if (set_charset(&iov, &iovlen, optarg) == -1)
 				err(EX_OSERR, "cd9660_iconv");
 			build_iovec(&iov, &iovlen, "kiconv", NULL, (size_t)-1);
 			break;
@@ -234,7 +234,7 @@ get_ssector(const char *dev)
 }
 
 static int
-set_charset(struct iovec *iov, int *iovlen, const char *localcs)
+set_charset(struct iovec **iov, int *iovlen, const char *localcs)
 {
 	int error;
 	char *cs_disk;	/* disk charset for Joliet cs conversion */
@@ -260,8 +260,8 @@ set_charset(struct iovec *iov, int *iovlen, const char *localcs)
 	if (error)
 		return (-1);
 	
-	build_iovec(&iov, iovlen, "cs_disk", cs_disk, (size_t)-1);
-	build_iovec(&iov, iovlen, "cs_local", cs_local, (size_t)-1);
+	build_iovec(iov, iovlen, "cs_disk", cs_disk, (size_t)-1);
+	build_iovec(iov, iovlen, "cs_local", cs_local, (size_t)-1);
 
 	return (0);
 }