skill: Prevent multiple overflows in ENLIST().

First problem: saved_argc was used to calculate the size of the array,
but saved_argc was never initialized. This triggers an immediate heap-
based buffer overflow:

$ skill -c0 -c0 -c0 -c0
Segmentation fault (core dumped)

Second problem: saved_argc was not the upper bound anyway, because one
argument can ENLIST() several times (for example, in parse_namespaces())
and overflow the array as well.

Third problem: integer overflow of the size of the array.

diff --git a/skill.c b/skill.c
index 012f5a116f49d0e005ac5df0763422fce0ede0a8..effd778888490843aab54436ccae4b1d6607773c 100644 (file)
--- a/skill.c
+++ b/skill.c
@@ -68,13 +68,13 @@ static int ns_pid;
 static proc_t ns_task;
 
 #define ENLIST(thing,addme) do{ \
-if(!thing##s) thing##s = xmalloc(sizeof(*thing##s)*saved_argc); \
+if(thing##_count < 0 || (size_t)thing##_count >= INT_MAX / sizeof(*thing##s)) \
+       xerrx(EXIT_FAILURE, _("integer overflow")); \
+thing##s = xrealloc(thing##s, sizeof(*thing##s)*(thing##_count+1)); \
 thing##s[thing##_count++] = addme; \
 }while(0)
 
 static int my_pid;
-static int saved_argc;
-
 static int sig_or_pri;
 
 enum {