rc_getline keeps expanding it's malloced buffer until it has read a whole line or EOF. All functions which read into static buffers have been changed to use fhis function to avoid any potential overflows and to ensure we really do read a long long config line.

5 files changed, 25 insertions, 33 deletions

diff --git a/src/rc/rc-logger.c b/src/rc/rc-logger.c
index 675a4d2..f4c610a 100644
--- a/src/rc/rc-logger.c
+++ b/src/rc/rc-logger.c
@@ -181,12 +181,12 @@ void rc_logger_open (const char *level)
 				write_time (log, "started");
 			else {
 				free (logbuf);
-				logbuf_size = RC_LINEBUFFER * 10;
+				logbuf_size = BUFSIZ * 10;
 				logbuf = xmalloc (sizeof (char) * logbuf_size);
 				logbuf_len = 0;
 			}
 
-			buffer = xmalloc (sizeof (char) * RC_LINEBUFFER);
+			buffer = xmalloc (sizeof (char) * BUFSIZ);
 			selfd = rc_logger_tty > signal_pipe[0] ? rc_logger_tty : signal_pipe[0];
 			while (1) {
 				FD_ZERO (&rset);
@@ -200,15 +200,15 @@ void rc_logger_open (const char *level)
 
 				if (s > 0) {
 					if (FD_ISSET (rc_logger_tty, &rset)) {
-						memset (buffer, 0, RC_LINEBUFFER);
-						bytes = read (rc_logger_tty, buffer, RC_LINEBUFFER);
+						memset (buffer, 0, BUFSIZ);
+						bytes = read (rc_logger_tty, buffer, BUFSIZ);
 						write (STDOUT_FILENO, buffer, bytes);
 
 						if (log)
 							write_log (fileno (log), buffer, bytes);
 						else {
 							if (logbuf_size - logbuf_len < bytes) {
-								logbuf_size += RC_LINEBUFFER * 10;
+								logbuf_size += BUFSIZ * 10;
 								logbuf = xrealloc (logbuf, sizeof (char ) *
 												   logbuf_size);
 							}
diff --git a/src/rc/rc-misc.c b/src/rc/rc-misc.c
index 85d7cd7..79db432 100644
--- a/src/rc/rc-misc.c
+++ b/src/rc/rc-misc.c
@@ -238,7 +238,7 @@ char **env_filter (void)
 static bool file_regex (const char *file, const char *regex)
 {
 	FILE *fp;
-	char *buffer;
+	char *line;
 	regex_t re;
 	bool retval = false;
 	int result;
@@ -246,23 +246,22 @@ static bool file_regex (const char *file, const char *regex)
 	if (! (fp = fopen (file, "r")))
 		return (false);
 
-	buffer = xmalloc (sizeof (char) * RC_LINEBUFFER);
 	if ((result = regcomp (&re, regex, REG_EXTENDED | REG_NOSUB)) != 0) {
 		fclose (fp);
-		regerror (result, &re, buffer, RC_LINEBUFFER);
-		fprintf (stderr, "file_regex: %s", buffer);
-		free (buffer);
+		line = xmalloc (sizeof (char) * BUFSIZ);
+		regerror (result, &re, line, BUFSIZ);
+		fprintf (stderr, "file_regex: %s", line);
+		free (line);
 		return (false);
 	}
 
-	while (fgets (buffer, RC_LINEBUFFER, fp)) {
-		if (regexec (&re, buffer, 0, NULL, 0) == 0)
-		{
+	while ((line = rc_getline (fp))) {
+		if (regexec (&re, line, 0, NULL, 0) == 0)
 			retval = true;
+		free (line);
+		if (retval)
 			break;
-		}
 	}
-	free (buffer);
 	fclose (fp);
 	regfree (&re);
 
diff --git a/src/rc/rc-plugin.c b/src/rc/rc-plugin.c
index 613f049..861f064 100644
--- a/src/rc/rc-plugin.c
+++ b/src/rc/rc-plugin.c
@@ -197,10 +197,10 @@ void rc_plugin_run (rc_hook_t hook, const char *value)
 				ssize_t nr;
 
 				close (pfd[1]);
-				buffer = xmalloc (sizeof (char) * RC_LINEBUFFER);
-				memset (buffer, 0, RC_LINEBUFFER);
+				buffer = xmalloc (sizeof (char) * BUFSIZ);
+				memset (buffer, 0, BUFSIZ);
 
-				while ((nr = read (pfd[0], buffer, RC_LINEBUFFER)) > 0) {
+				while ((nr = read (pfd[0], buffer, BUFSIZ)) > 0) {
 					p = buffer;
 					while (*p && p - buffer < nr) {
 						token = strsep (&p, "=");
diff --git a/src/rc/rc.c b/src/rc/rc.c
index 6874efc..c94bf11 100644
--- a/src/rc/rc.c
+++ b/src/rc/rc.c
@@ -479,7 +479,7 @@ static int do_shell_var (int argc, char **argv)
 static char *proc_getent (const char *ent)
 {
 	FILE *fp;
-	char *buffer;
+	char *proc;
 	char *p;
 	char *value = NULL;
 	int i;
@@ -492,18 +492,11 @@ static char *proc_getent (const char *ent)
 		return (NULL);
 	}
 
-	buffer = xmalloc (sizeof (char) * RC_LINEBUFFER);
-	memset (buffer, 0, RC_LINEBUFFER);
-	if (fgets (buffer, RC_LINEBUFFER, fp) &&
-		(p = strstr (buffer, ent)))
+	if ((proc = rc_getline (fp)) &&
+		(p = strstr (proc, ent)))
 	{ 
-		i = p - buffer;
-		if (i == '\0' || buffer[i - 1] == ' ') {
-			/* Trim the trailing carriage return if present */
-			i = strlen (buffer) - 1;
-			if (buffer[i] == '\n')
-				buffer[i] = 0;
-
+		i = p - proc;
+		if (i == '\0' || proc[i - 1] == ' ') {
 			p += strlen (ent);
 			if (*p == '=')
 				p++;
@@ -511,7 +504,7 @@ static char *proc_getent (const char *ent)
 		}
 	} else
 		errno = ENOENT;
-	free (buffer);
+	free (proc);
 	fclose (fp);
 
 	return (value);
diff --git a/src/rc/runscript.c b/src/rc/runscript.c
index fdb0496..0e750c5 100644
--- a/src/rc/runscript.c
+++ b/src/rc/runscript.c
@@ -451,7 +451,7 @@ static bool svc_exec (const char *arg1, const char *arg2)
 	}
 
 	selfd = MAX (master_tty, signal_pipe[0]) + 1;
-	buffer = xmalloc (sizeof (char) * RC_LINEBUFFER);
+	buffer = xmalloc (sizeof (char) * BUFSIZ);
 	while (1) {
 		FD_ZERO (&rset);
 		FD_SET (signal_pipe[0], &rset);
@@ -467,7 +467,7 @@ static bool svc_exec (const char *arg1, const char *arg2)
 
 		if (s > 0) {
 			if (master_tty >= 0 && FD_ISSET (master_tty, &rset)) {
-				bytes = read (master_tty, buffer, RC_LINEBUFFER);
+				bytes = read (master_tty, buffer, BUFSIZ);
 				write_prefix (buffer, bytes, &prefixed);
 			}