In fill_cmnd(), collapse any escaped sudo-specific characters.

Allows character classes to be used in pathnames.

diff --git a/toke.c b/toke.c
index 0655a6167c8dd66faad4708bccd38fec249a4527..03541b351d95d04dd143974fc711c518fe9cdcad 100644 (file)
--- a/toke.c
+++ b/toke.c
@@ -3111,21 +3111,33 @@ append(src, len)
     return(_fill(src, len, olen));
 }
 
+#define SPECIAL(c) \
+    ((c) == ',' || (c) == ':' || (c) == '=' || (c) == ' ' || (c) == '\t' || (c) == '#')
+
 static int
-fill_cmnd(s, len)
-    char *s;
+fill_cmnd(src, len)
+    char *src;
     int len;
 {
+    char *dst;
+    int i;
+
     arg_len = arg_size = 0;
 
-    yylval.command.cmnd = (char *) malloc(++len);
+    dst = yylval.command.cmnd = (char *) malloc(++len);
     if (yylval.command.cmnd == NULL) {
        yyerror("unable to allocate memory");
        return(FALSE);
     }
 
-    /* copy the string and NULL-terminate it (escapes handled by fnmatch) */
-    (void) strlcpy(yylval.command.cmnd, s, len);
+    /* Copy the string and collapse any escaped sudo-specific characters. */
+    for (i = 0; i < len; i++) {
+       if (src[i] == '\\' && i != len - 1 && SPECIAL(src[i + 1]))
+           *dst++ = src[++i];
+       else
+           *dst++ = src[i];
+    }
+    *dst = '\0';
 
     yylval.command.args = NULL;
     return(TRUE);

diff --git a/toke.l b/toke.l
index fb026c8e30262e725875d723cccc0bf950d47971..353ab2d11d8979d05836eacac8850f97d3476b12 100644 (file)
--- a/toke.l
+++ b/toke.l
@@ -530,21 +530,33 @@ append(src, len)
     return(_fill(src, len, olen));
 }
 
+#define SPECIAL(c) \
+    ((c) == ',' || (c) == ':' || (c) == '=' || (c) == ' ' || (c) == '\t' || (c) == '#')
+
 static int
-fill_cmnd(s, len)
-    char *s;
+fill_cmnd(src, len)
+    char *src;
     int len;
 {
+    char *dst;
+    int i;
+
     arg_len = arg_size = 0;
 
-    yylval.command.cmnd = (char *) malloc(++len);
+    dst = yylval.command.cmnd = (char *) malloc(++len);
     if (yylval.command.cmnd == NULL) {
        yyerror("unable to allocate memory");
        return(FALSE);
     }
 
-    /* copy the string and NULL-terminate it (escapes handled by fnmatch) */
-    (void) strlcpy(yylval.command.cmnd, s, len);
+    /* Copy the string and collapse any escaped sudo-specific characters. */
+    for (i = 0; i < len; i++) {
+       if (src[i] == '\\' && i != len - 1 && SPECIAL(src[i + 1]))
+           *dst++ = src[++i];
+       else
+           *dst++ = src[i];
+    }
+    *dst = '\0';
 
     yylval.command.args = NULL;
     return(TRUE);