regen

diff --git a/lex.yy.c b/lex.yy.c
index 4fb1aeeb0f0c03c36926b65b1f50eadd8e743a87..8025ed0edc8981882ba1eb2b4f0a014f45defff3 100644 (file)
--- a/lex.yy.c
+++ b/lex.yy.c
@@ -2518,41 +2518,31 @@ fill_args(s, len, addspace)
     int new_len;
     char *p;
 
-    /*
-     * If first arg, malloc() some room, else if we don't
-     * have enough space realloc() some more.
-     */
     if (yylval.command.args == NULL) {
        addspace = 0;
        new_len = len;
+    } else
+       new_len = arg_len + len + addspace;
 
+    if (new_len >= arg_size) {
+       /* Allocate more space than we need for subsequent args */
        while (new_len >= (arg_size += COMMANDARGINC))
            ;
 
-       yylval.command.args = (char *) malloc(arg_size);
-       if (yylval.command.args == NULL)
-           yyerror("unable to allocate memory");
-    } else {
-       new_len = arg_len + len + addspace;
-
-       if (new_len >= arg_size) {
-           /* Allocate more space than we need for subsequent args */
-           while (new_len >= (arg_size += COMMANDARGINC))
-               ;
-
-           if ((p = (char *) realloc(yylval.command.args, arg_size)) == NULL) {
+       if ((p = (char *) realloc(yylval.command.args, arg_size)) == NULL) {
+           if (yylval.command.args != NULL)
                free(yylval.command.args);
-               yyerror("unable to allocate memory");
-           } else
-               yylval.command.args = p;
-       }
+           yyerror("unable to allocate memory");
+       } else
+           yylval.command.args = p;
     }
 
     /* Efficiently append the arg (with a leading space if needed). */
     p = yylval.command.args + arg_len;
     if (addspace)
        *p++ = ' ';
-    (void) strcpy(p, s);
+    if (strlcpy(p, s, arg_size - (p - yylval.command.args)) != len)
+       yyerror("fill_args: buffer overflow");  /* paranoia */
     arg_len = new_len;
 }