From: Ralph Corderoy <ralph@inputplus.co.uk>
Date: Tue, 23 Jan 2018 09:18:34 +0000 (+0000)
Subject: mhshow: Avoid SEGV when user's command has two or fewer words.
X-Git-Url: https://diplodocus.org/git/nmh/commitdiff_plain/20fdce3e9137be985ffb22a2c97c51bcd45f72e0?hp=c349c172bd195190c0ddb7754644f16ba8545fda

mhshow: Avoid SEGV when user's command has two or fewer words.

After argsplit() returned a NULL-terminated vector, the existing NULL
was overwritten with another and the vector index then incremented.
This made the test for whether vec[2] was available out by one resulting
in NULL being used and printed.

This plucking of the third word is a faulty assumption as argsplit()
doesn't always return ["sh", "-c", ...], but add a new test script for
it to avoid regression and so that the script can be expanded with more
related tests.

Fixes 7559e1ebf.
---

diff --git a/Makefile.am b/Makefile.am
index 7694abc4..d8f92345 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -106,6 +106,7 @@ TESTS = \
     test/mhshow/test-binary \
     test/mhshow/test-charset \
     test/mhshow/test-cte-binary \
+    test/mhshow/test-exec \
     test/mhshow/test-msg-buffer-boundaries \
     test/mhshow/test-qp \
     test/mhshow/test-subpart \
diff --git a/test/mhshow/test-exec b/test/mhshow/test-exec
new file mode 100755
index 00000000..7589b47d
--- /dev/null
+++ b/test/mhshow/test-exec
@@ -0,0 +1,54 @@
+#! /bin/sh
+
+# Test production and execution of user's commands.
+
+set -e
+
+if test -z "${MH_OBJ_DIR}"; then
+    srcdir=`dirname "$0"`/../..
+    MH_OBJ_DIR=`cd "$srcdir" && pwd`; export MH_OBJ_DIR
+fi
+
+. "$MH_OBJ_DIR/test/common.sh"
+
+setup_test
+
+got="$MH_TEST_DIR"/$$.got
+want="$MH_TEST_DIR"/$$.want
+
+# The third word, if it exists, of the command executed is plucked as
+# the name to display on the faulty assumption the arguments start ["sh",
+# "-c"].  Plucking occurred for NULL in the past so test it here.
+start_test 'plucking of third word for command'\''s display name'
+email=`mhpath new`
+cat >"$email" <<\E
+From: foo@example.edu
+MIME-Version: 1.0
+Content-Type: text/foo
+Date: Sun, 18 Dec 2005 00:52:39 +0100
+
+E
+cp "$MH" "$MH.orig"
+cmd= argv2=
+for w in false foo bar xyzzy; do
+    cmd="$cmd $w"
+    if test $w = bar; then argv2="$w: "; fi
+    cp "$MH.orig" "$MH"
+    echo "mhshow-show-text/foo: $cmd" >>"$MH"
+    set +e
+    run_prog mhshow last >"$got" 2>&1
+    set -e
+    cat >"$want" <<\E
+[ Message inbox:11 ]
+Date:    Sun, 18 Dec 2005 00:52:39 +0100
+From:    foo@example.edu
+
+MIME-Version: 1.0
+
+E
+    echo "${argv2}exited 1" >>"$want"
+    check "$want" "$got" : check "word $w"
+done
+mv "$MH.orig" "$MH"
+
+finish_test
diff --git a/uip/mhshowsbr.c b/uip/mhshowsbr.c
index fccf3c18..e4c93a87 100644
--- a/uip/mhshowsbr.c
+++ b/uip/mhshowsbr.c
@@ -470,7 +470,6 @@ show_content_aux2 (CT ct, int alternate, char *cracked, char *buffer,
     }
 
     vec = argsplit(buffer, &file, &vecp);
-    vec[vecp++] = NULL;
 
     fflush (stdout);