Make sure we don't blow up if the user enters a lot of stuff (buff is normally a char[512], so if user gives us 5000 chars ...). Also trim unused/duplicated variables. Patch by Mike Frysinger --- pcalc-000/pcalc.y +++ pcalc-000/pcalc.y @@ -148,13 +148,6 @@ int (*ptr_getchar)(); int (*ptr_ungetc)(); -FILE *in_fp = NULL; - -int len; -char buff[512]; - -FILE *in_fp; - int main(int argc, char *argv[]) { @@ -203,8 +203,16 @@ int len, cnt; int tmpfile; + char buff[512]; + len = 0; for(cnt = args+1; cnt < argc; cnt++) { + len += strlen(argv[cnt]) + 1; + if (len >= sizeof(buff)) + { + fprintf(stderr, "Input is too long (max of %lu chars allowed)\n", (unsigned long)sizeof(buff)); + exit(1); + } strcat(buff, argv[cnt]); strcat(buff, " "); }