Avoid problems with pathological input during edit operations. i.e. never

attempt to use data past the end of the input.

Since the return value of ask_cmd() is never checked, make it void instead
of int.

Problems found, original diff from and ok tim@.

2 files changed, 14 insertions, 15 deletions

diff --git a/sbin/fdisk/misc.c b/sbin/fdisk/misc.c
index e87c806a41f..b58d6eab345 100644
--- a/sbin/fdisk/misc.c
+++ b/sbin/fdisk/misc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: misc.c,v 1.55 2015/11/03 14:20:00 krw Exp $	*/
+/*	$OpenBSD: misc.c,v 1.56 2015/11/12 15:07:41 krw Exp $	*/
 
 /*
  * Copyright (c) 1997 Tobias Weingartner
@@ -84,25 +84,24 @@ string_from_line(char *buf, size_t buflen)
 	return (0);
 }
 
-int
-ask_cmd(char **cmd, char **args)
+void
+ask_cmd(char **cmd, char **arg)
 {
 	static char lbuf[100];
-	char *cp, *buf;
+	size_t cmdstart, cmdend, argstart;
 
-	/* Get input */
+	/* Get NUL terminated string from stdin. */
 	if (string_from_line(lbuf, sizeof(lbuf)))
 		errx(1, "eof");
 
-	/* Parse input */
-	buf = lbuf;
-	buf = &buf[strspn(buf, " \t")];
-	cp = &buf[strcspn(buf, " \t")];
-	*cp++ = '\0';
-	*cmd = buf;
-	*args = &cp[strspn(cp, " \t")];
+	cmdstart = strspn(lbuf, " \t");
+	cmdend = cmdstart + strcspn(&lbuf[cmdstart], " \t");
+	argstart = cmdend + strspn(&lbuf[cmdend], " \t");
 
-	return (0);
+	/* *cmd and *arg may be set to point at final NUL! */
+	*cmd = &lbuf[cmdstart];
+	lbuf[cmdend] = '\0';
+	*arg = &lbuf[argstart];
 }
 
 int
diff --git a/sbin/fdisk/misc.h b/sbin/fdisk/misc.h
index 263fbd2d5c5..3724cdee928 100644
--- a/sbin/fdisk/misc.h
+++ b/sbin/fdisk/misc.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: misc.h,v 1.31 2015/10/26 15:08:26 krw Exp $	*/
+/*	$OpenBSD: misc.h,v 1.32 2015/11/12 15:07:41 krw Exp $	*/
 
 /*
  * Copyright (c) 1997 Tobias Weingartner
@@ -30,7 +30,7 @@ extern struct unit_type unit_types[];
 /* Prototypes */
 int unit_lookup(char *);
 int string_from_line(char *, size_t);
-int ask_cmd(char **, char **);
+void ask_cmd(char **, char **);
 int ask_num(const char *, int, int, int);
 int ask_pid(int, struct uuid *);
 char *ask_string(const char *, const char *);