Rework some of the -I support so I can't find a way to make xargs(1) core or

corrupt memory.  Simplifies the code in one or two places, also removes some
code that looks like it was bogus or incomplete.

Update strnsubst to have one or two extra conditions which maybe would make
it more efficient, or at least more versatile.  This is likely a no-op.

2 files changed, 14 insertions, 15 deletions

diff --git a/usr.bin/xargs/strnsubst.c b/usr.bin/xargs/strnsubst.c
index a06197e..bb8b20e 100644
--- a/usr.bin/xargs/strnsubst.c
+++ b/usr.bin/xargs/strnsubst.c
@@ -38,6 +38,11 @@ strnsubst(char **str, const char *match, const char *replstr, size_t maxsize)
 	if (s2 == NULL)
 		err(1, "calloc");
 
+	if (match == NULL || replstr == NULL || maxsize == strlen(*str)) {
+		strlcpy(s2, s1, maxsize);
+		goto done;
+	}
+
 	for (;;) {
 		char *this;
 
diff --git a/usr.bin/xargs/xargs.c b/usr.bin/xargs/xargs.c
index 1ec7766..ae18ea8 100644
--- a/usr.bin/xargs/xargs.c
+++ b/usr.bin/xargs/xargs.c
@@ -76,7 +76,7 @@ int
 main(int argc, char **argv)
 {
 	long arg_max;
-	int argumentc, ch, cnt, count, Iflag, indouble, insingle, jfound, lflag;
+	int ch, cnt, count, Iflag, indouble, insingle, jfound, lflag;
 	int nargs, nflag, nline, wasquoted, foundeof, xflag;
 	size_t linelen;
 	const char *eofstr;
@@ -86,8 +86,7 @@ main(int argc, char **argv)
 	ep = environ;
 	inpline = replstr = NULL;
 	eofstr = "";
-	argumentc = cnt = count = Iflag = jfound = lflag = nflag = xflag =
-	    wasquoted = 0;
+	cnt = count = Iflag = jfound = lflag = nflag = xflag = wasquoted = 0;
 
 	/*
 	 * POSIX.2 limits the exec line length to ARG_MAX - 2K.  Running that
@@ -166,8 +165,8 @@ main(int argc, char **argv)
 	 * NULL.
 	 */
 	linelen = 1 + argc + nargs + 1;
-	if ((av = bxp = calloc(linelen * sizeof(char **), 1)) == NULL)
-		err(1, "calloc");
+	if ((av = bxp = malloc(linelen * sizeof(char **))) == NULL)
+		err(1, "malloc");
 
 	/*
 	 * Use the user's name for the utility as argv[0], just like the
@@ -258,9 +257,8 @@ arg2:
 							strcat(inpline, " ");
 					}
 					curlen++;
-					argumentc++;
 					inpline = realloc(realloc_holder, strlen(argp) +
-					    curlen);
+					    curlen + 2);
 					if (inpline == NULL)
 						err(1, "realloc");
 					if (curlen == 1)
@@ -285,12 +283,14 @@ arg2:
 				if (Iflag) {
 					char **tmp, **tmp2;
 					size_t repls;
+					int iter;
 
-					tmp = calloc(linelen * sizeof(char **), 1);
+					tmp = malloc(linelen * sizeof(char **));
 					if (tmp == NULL)
 						err(1, "malloc");
 					tmp2 = tmp;
-					for (repls = 5, avj = av; *avj != NULL; avj++) {
+					repls = 5;
+					for (avj = av, iter = argc; iter; avj++, iter--) {
 						*tmp = *avj;
 						if (avj != av && repls > 0 &&
 						    strstr(*tmp, replstr) != NULL) {
@@ -305,11 +305,6 @@ arg2:
 						}
 						tmp++;
 					}
-					do {
-						if (*tmp != NULL)
-							free(*tmp);
-						tmp--;
-					} while (--argumentc);
 					*tmp = *xp = NULL;
 					run(tmp2);
 					for (; tmp2 != tmp; tmp--)
@@ -317,7 +312,6 @@ arg2:
 					free(tmp2);
 					free(inpline);
 					inpline = strdup("");
-					argumentc = 0;
 				} else {
 					*xp = NULL;
 					run(av);