Blame SOURCES/sudo-1.8.6p3-lbufexpandcode.patch

1b092f
diff -up sudo-1.8.6p3/common/lbuf.c.lbufexpandcode sudo-1.8.6p3/common/lbuf.c
1b092f
--- sudo-1.8.6p3/common/lbuf.c.lbufexpandcode	2013-08-12 17:28:52.429562473 +0200
1b092f
+++ sudo-1.8.6p3/common/lbuf.c	2013-08-12 17:29:21.486668465 +0200
1b092f
@@ -77,6 +77,17 @@ lbuf_destroy(struct lbuf *lbuf)
1b092f
     debug_return;
1b092f
 }
1b092f
 
1b092f
+static void
1b092f
+lbuf_expand(struct lbuf *lbuf, size_t extra)
1b092f
+{
1b092f
+    if (lbuf->len + extra + 1 >= lbuf->size) {
1b092f
+	do {
1b092f
+	    lbuf->size += 256;
1b092f
+	} while (lbuf->len + extra + 1 >= lbuf->size);
1b092f
+	lbuf->buf = erealloc(lbuf->buf, lbuf->size);
1b092f
+    }
1b092f
+}
1b092f
+
1b092f
 /*
1b092f
  * Parse the format and append strings, only %s and %% escapes are supported.
1b092f
  * Any characters in set are quoted with a backslash.
1b092f
@@ -86,47 +97,40 @@ lbuf_append_quoted(struct lbuf *lbuf, co
1b092f
 {
1b092f
     va_list ap;
1b092f
     int len;
1b092f
-    char *cp, *s = NULL;
1b092f
+    char *cp, *s;
1b092f
     debug_decl(lbuf_append_quoted, SUDO_DEBUG_UTIL)
1b092f
 
1b092f
     va_start(ap, fmt);
1b092f
     while (*fmt != '\0') {
1b092f
-	len = 1;
1b092f
 	if (fmt[0] == '%' && fmt[1] == 's') {
1b092f
-	    s = va_arg(ap, char *);
1b092f
-	    len = strlen(s);
1b092f
-	}
1b092f
-	/* Assume worst case that all chars must be escaped. */
1b092f
-	if (lbuf->len + (len * 2) + 1 >= lbuf->size) {
1b092f
-	    do {
1b092f
-		lbuf->size += 256;
1b092f
-	    } while (lbuf->len + len + 1 >= lbuf->size);
1b092f
-	    lbuf->buf = erealloc(lbuf->buf, lbuf->size);
1b092f
-	}
1b092f
-	if (*fmt == '%') {
1b092f
-	    if (*(++fmt) == 's') {
1b092f
-		while ((cp = strpbrk(s, set)) != NULL) {
1b092f
-		    len = (int)(cp - s);
1b092f
-		    memcpy(lbuf->buf + lbuf->len, s, len);
1b092f
-		    lbuf->len += len;
1b092f
-		    lbuf->buf[lbuf->len++] = '\\';
1b092f
-		    lbuf->buf[lbuf->len++] = *cp;
1b092f
-		    s = cp + 1;
1b092f
-		}
1b092f
-		if (*s != '\0') {
1b092f
-		    len = strlen(s);
1b092f
-		    memcpy(lbuf->buf + lbuf->len, s, len);
1b092f
-		    lbuf->len += len;
1b092f
-		}
1b092f
-		fmt++;
1b092f
-		continue;
1b092f
+	    if ((s = va_arg(ap, char *)) == NULL)
1b092f
+		goto done;
1b092f
+	    while ((cp = strpbrk(s, set)) != NULL) {
1b092f
+		len = (int)(cp - s);
1b092f
+		lbuf_expand(lbuf, len + 2);
1b092f
+		memcpy(lbuf->buf + lbuf->len, s, len);
1b092f
+		lbuf->len += len;
1b092f
+		lbuf->buf[lbuf->len++] = '\\';
1b092f
+		lbuf->buf[lbuf->len++] = *cp;
1b092f
+		s = cp + 1;
1b092f
 	    }
1b092f
+	    if (*s != '\0') {
1b092f
+		len = strlen(s);
1b092f
+		lbuf_expand(lbuf, len);
1b092f
+		memcpy(lbuf->buf + lbuf->len, s, len);
1b092f
+		lbuf->len += len;
1b092f
+	    }
1b092f
+	    fmt += 2;
1b092f
+	    continue;
1b092f
 	}
1b092f
+	lbuf_expand(lbuf, 2);
1b092f
 	if (strchr(set, *fmt) != NULL)
1b092f
 	    lbuf->buf[lbuf->len++] = '\\';
1b092f
 	lbuf->buf[lbuf->len++] = *fmt++;
1b092f
     }
1b092f
-    lbuf->buf[lbuf->len] = '\0';
1b092f
+done:
1b092f
+    if (lbuf->size != 0)
1b092f
+	lbuf->buf[lbuf->len] = '\0';
1b092f
     va_end(ap);
1b092f
 
1b092f
     debug_return;
1b092f
@@ -140,33 +144,27 @@ lbuf_append(struct lbuf *lbuf, const cha
1b092f
 {
1b092f
     va_list ap;
1b092f
     int len;
1b092f
-    char *s = NULL;
1b092f
+    char *s;
1b092f
     debug_decl(lbuf_append, SUDO_DEBUG_UTIL)
1b092f
 
1b092f
     va_start(ap, fmt);
1b092f
     while (*fmt != '\0') {
1b092f
-	len = 1;
1b092f
 	if (fmt[0] == '%' && fmt[1] == 's') {
1b092f
-	    s = va_arg(ap, char *);
1b092f
+	    if ((s = va_arg(ap, char *)) == NULL)
1b092f
+		goto done;
1b092f
 	    len = strlen(s);
1b092f
+	    lbuf_expand(lbuf, len);
1b092f
+	    memcpy(lbuf->buf + lbuf->len, s, len);
1b092f
+	    lbuf->len += len;
1b092f
+	    fmt += 2;
1b092f
+	    continue;
1b092f
 	}
1b092f
-	if (lbuf->len + len + 1 >= lbuf->size) {
1b092f
-	    do {
1b092f
-		lbuf->size += 256;
1b092f
-	    } while (lbuf->len + len + 1 >= lbuf->size);
1b092f
-	    lbuf->buf = erealloc(lbuf->buf, lbuf->size);
1b092f
-	}
1b092f
-	if (*fmt == '%') {
1b092f
-	    if (*(++fmt) == 's') {
1b092f
-		memcpy(lbuf->buf + lbuf->len, s, len);
1b092f
-		lbuf->len += len;
1b092f
-		fmt++;
1b092f
-		continue;
1b092f
-	    }
1b092f
-	}
1b092f
+	lbuf_expand(lbuf, 1);
1b092f
 	lbuf->buf[lbuf->len++] = *fmt++;
1b092f
     }
1b092f
-    lbuf->buf[lbuf->len] = '\0';
1b092f
+done:
1b092f
+    if (lbuf->size != 0)
1b092f
+	lbuf->buf[lbuf->len] = '\0';
1b092f
     va_end(ap);
1b092f
 
1b092f
     debug_return;