Rewrite a confusing loop when freeing the arg array on exit and move the check

for argv being NULL, prompted by parfait via deraadt.

Also fix some definite brokenness when assigning multiple environment variables
in arguments (such as "X=1 Y=2").

1 files changed, 9 insertions, 10 deletions

diff --git a/cmd-string.c b/cmd-string.c
index 06f01a54..7af34fb0 100644
--- a/cmd-string.c
+++ b/cmd-string.c
@@ -134,17 +134,15 @@ cmd_string_parse(const char *s, struct cmd_list **cmdlist, char **cause)
 
 			if (ch != EOF)
 				break;
-			if (argc == 0)
-				goto out;
 
-			for (i = 0; i < argc; i++) {
-				equals = strchr(argv[i], '=');
-				whitespace = argv[i] + strcspn(argv[i], " \t");
+			while (argc != 0) {
+				equals = strchr(argv[0], '=');
+				whitespace = argv[0] + strcspn(argv[0], " \t");
 				if (equals == NULL || equals > whitespace)
 					break;
-				environ_put(&global_environ, argv[i]);
-				memmove(&argv[i], &argv[i + 1], argc - i - 1);
+				environ_put(&global_environ, argv[0]);
 				argc--;
+				memmove(argv, argv + 1, argc * (sizeof *argv));
 			}
 			if (argc == 0)
 				goto out;
@@ -189,10 +187,11 @@ out:
 	if (buf != NULL)
 		xfree(buf);
 
-	while (--argc >= 0)
-		xfree(argv[argc]);
-	if (argv != NULL)
+	if (argv != NULL) {
+		for (i = 0; i < argc; i++)
+			xfree(argv[argc]);
 		xfree(argv);
+	}
 
 	return (rval);
 }