When running 'rrestore foo', you get a segmentation fault because

the obsolete() function to convert dump-style args to getopt-style
args doesn't check to see that 'f' really has an argument following
the option string in argv[1].

Submitted-By: jmacd

1 files changed, 3 insertions, 1 deletions

diff --git a/sbin/restore/main.c b/sbin/restore/main.c
index e2d8eeb..936116e 100644
--- a/sbin/restore/main.c
+++ b/sbin/restore/main.c
@@ -308,13 +308,15 @@ obsolete(argcp, argvp)
 		err(1, NULL);
 
 	*nargv++ = *argv;
-	argv += 2;
+	argv += 2, argc -= 2;
 
 	for (flags = 0; *ap; ++ap) {
 		switch(*ap) {
 		case 'b':
 		case 'f':
 		case 's':
+                      if (argc < 1)
+                              usage();
 			if ((nargv[0] = malloc(strlen(*argv) + 2 + 1)) == NULL)
 				err(1, NULL);
 			nargv[0][0] = '-';