Fix potential fault where -L/-R/-D could accept a string too long for our

[u/mdw/putty] / cmdline.c

diff --git a/cmdline.c b/cmdline.c
index 2a05484..fdd9584 100644 (file)
--- a/cmdline.c
+++ b/cmdline.c
@@ -111,6 +111,12 @@ static int cmdline_check_unavailable(int flag, char *p)
  * Process a standard command-line parameter. `p' is the parameter
  * in question; `value' is the subsequent element of argv, which
  * may or may not be required as an operand to the parameter.
+ * If `need_save' is 1, arguments which need to be saved as
+ * described at this top of this file are, for later execution;
+ * if 0, they are processed normally. (-1 is a special value used
+ * by pterm to count arguments for a preliminary pass through the
+ * argument list; it causes immediate return with an appropriate
+ * value with no action taken.)
  * Return value is 2 if both arguments were used; 1 if only p was
  * used; 0 if the parameter wasn't one we recognised; -2 if it
  * should have been 2 but value was NULL.
@@ -131,6 +137,7 @@ int cmdline_process_param(char *p, char *value, int need_save, Config *cfg)
        /* This parameter must be processed immediately rather than being
         * saved. */
        do_defaults(value, cfg);
+       loaded_session = TRUE;
        return 2;
     }
     if (!strcmp(p, "-ssh")) {
@@ -183,19 +190,20 @@ int cmdline_process_param(char *p, char *value, int need_save, Config *cfg)
        dynamic = !strcmp(p, "-D");
        fwd = value;
        ptr = cfg->portfwd;
-       /* if multiple forwards, find end of list */
-       if (ptr[0]=='R' || ptr[0]=='L' || ptr[0] == 'D') {
-           for (i = 0; i < sizeof(cfg->portfwd) - 2; i++)
-               if (ptr[i]=='\000' && ptr[i+1]=='\000')
-                   break;
-           ptr = ptr + i + 1;  /* point to next forward slot */
+       /* if existing forwards, find end of list */
+       while (*ptr) {
+           while (*ptr)
+               ptr++;
+           ptr++;
        }
+       i = ptr - cfg->portfwd;
        ptr[0] = p[1];  /* insert a 'L', 'R' or 'D' at the start */
-       if (strlen(fwd) > sizeof(cfg->portfwd) - i - 2) {
+       ptr++;
+       if (1 + strlen(fwd) + 2 > sizeof(cfg->portfwd) - i) {
            cmdline_error("out of space for port forwardings");
            return ret;
        }
-       strncpy(ptr+1, fwd, sizeof(cfg->portfwd) - i);
+       strncpy(ptr, fwd, sizeof(cfg->portfwd) - i - 2);
        if (!dynamic) {
            /*
             * We expect _at least_ two colons in this string. The
@@ -217,7 +225,7 @@ int cmdline_process_param(char *p, char *value, int need_save, Config *cfg)
        }
        cfg->portfwd[sizeof(cfg->portfwd) - 1] = '\0';
        cfg->portfwd[sizeof(cfg->portfwd) - 2] = '\0';
-       ptr[strlen(ptr)+1] = '\000';    /* append two '\000' */
+       ptr[strlen(ptr)+1] = '\000';    /* append 2nd '\000' */
     }
     if (!strcmp(p, "-m")) {
        char *filename, *command;
@@ -307,6 +315,13 @@ int cmdline_process_param(char *p, char *value, int need_save, Config *cfg)
        cfg->nopty = 1;
     }
 
+    if (!strcmp(p, "-N")) {
+       RETURN(1);
+       UNAVAILABLE_IN(TOOLTYPE_FILETRANSFER | TOOLTYPE_NONNETWORK);
+       SAVEABLE(0);
+       cfg->ssh_no_shell = 1;
+    }
+
     if (!strcmp(p, "-C")) {
        RETURN(1);
        UNAVAILABLE_IN(TOOLTYPE_NONNETWORK);
@@ -334,6 +349,17 @@ int cmdline_process_param(char *p, char *value, int need_save, Config *cfg)
        cfg->keyfile = filename_from_str(value);
     }
 
+    if (!strcmp(p, "-4") || !strcmp(p, "-ipv4")) {
+       RETURN(1);
+       SAVEABLE(1);
+       cfg->addressfamily = ADDRTYPE_IPV4;
+    }
+    if (!strcmp(p, "-6") || !strcmp(p, "-ipv6")) {
+       RETURN(1);
+       SAVEABLE(1);
+       cfg->addressfamily = ADDRTYPE_IPV6;
+    }
+
     return ret;                               /* unrecognised */
 }