diff options
| -rw-r--r-- | libexec/rexecd/rexecd.c | 9 | ||||
| -rw-r--r-- | libexec/rshd/rshd.c | 9 |
2 files changed, 14 insertions, 4 deletions
diff --git a/libexec/rexecd/rexecd.c b/libexec/rexecd/rexecd.c index a868720..ea8977f 100644 --- a/libexec/rexecd/rexecd.c +++ b/libexec/rexecd/rexecd.c @@ -132,7 +132,8 @@ main(int argc, char *argv[]) static void doit(struct sockaddr *fromp) { - char cmdbuf[NCARGS+1], *cp; + char *cmdbuf, *cp; + int maxcmdlen; char user[16], pass[16]; struct passwd *pwd; int fd, r, sd; @@ -142,6 +143,10 @@ doit(struct sockaddr *fromp) char buf[BUFSIZ], sig; int one = 1; + maxcmdlen = (int)sysconf(_SC_ARG_MAX); + if (maxcmdlen <= 0 || (cmdbuf = malloc(maxcmdlen)) == NULL) + exit(1); + (void) signal(SIGINT, SIG_DFL); (void) signal(SIGQUIT, SIG_DFL); (void) signal(SIGTERM, SIG_DFL); @@ -182,7 +187,7 @@ doit(struct sockaddr *fromp) } getstr(user, sizeof(user), "username"); getstr(pass, sizeof(pass), "password"); - getstr(cmdbuf, sizeof(cmdbuf), "command"); + getstr(cmdbuf, maxcmdlen, "command"); (void) alarm(0); if ((pwd = getpwnam(user)) == NULL || (pwd->pw_uid = 0 && no_uid_0) || diff --git a/libexec/rshd/rshd.c b/libexec/rshd/rshd.c index ea85388..b203bc9 100644 --- a/libexec/rshd/rshd.c +++ b/libexec/rshd/rshd.c @@ -195,12 +195,17 @@ doit(struct sockaddr *fromp) int one = 1; const char *cp, *errorstr; char sig, buf[BUFSIZ]; - char cmdbuf[NCARGS+1], luser[16], ruser[16]; + char *cmdbuf, luser[16], ruser[16]; char rhost[2 * MAXHOSTNAMELEN + 1]; char numericname[INET6_ADDRSTRLEN]; int af, srcport; + int maxcmdlen; login_cap_t *lc; + maxcmdlen = (int)sysconf(_SC_ARG_MAX); + if (maxcmdlen <= 0 || (cmdbuf = malloc(maxcmdlen)) == NULL) + exit(1); + (void) signal(SIGINT, SIG_DFL); (void) signal(SIGQUIT, SIG_DFL); (void) signal(SIGTERM, SIG_DFL); @@ -301,7 +306,7 @@ doit(struct sockaddr *fromp) (void) alarm(60); getstr(ruser, sizeof(ruser), "ruser"); getstr(luser, sizeof(luser), "luser"); - getstr(cmdbuf, sizeof(cmdbuf), "command"); + getstr(cmdbuf, maxcmdlen, "command"); (void) alarm(0); pam_err = pam_start("rsh", luser, &pamc, &pamh); |
