bin/108775: tip/cu core dump if $HOME is not set

[Alex Dupre]

>Number:         108775
>Category:       bin
>Synopsis:       tip/cu core dump if $HOME is not set
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Feb 04 21:30:15 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator:     Alex Dupre
>Release:        FreeBSD 6-STABLE i386
>Organization:
>Environment:
>Description:
The code doesn't check if HOME is not set and does a strlen on a NULL value.
>How-To-Repeat:
# unsetenv HOME
# cu -l /dev/cuad0
Segmentation fault (core dumped)
>Fix:
Untested patch follows:

--- src/usr.bin/tip/tip/value.c  31 Aug 2006 19:19:44 -0000      1.11
+++ src/usr.bin/tip/tip/value.c  4 Feb 2007 21:25:21 -0000
@@ -74,22 +74,25 @@
          * Read the .tiprc file in the HOME directory
          *  for sets
          */
-        if (strlen(value(HOME)) + sizeof("/.tiprc") > sizeof(file)) {
-                (void)fprintf(stderr, "Home directory path too long: %s\n",
-                    value(HOME));
-        } else {
-                snprintf(file, sizeof file, "%s/.tiprc", value(HOME));
-                if ((fp = fopen(file, "r")) != NULL) {
-                        char *tp;
-
-                        while (fgets(file, sizeof(file)-1, fp) != NULL) {
-                                if (vflag)
-                                        printf("set %s", file);
-                                if ((tp = strrchr(file, '\n')))
-                                        *tp = '\0';
-                                vlex(file);
+        cp = value(HOME);
+        if (cp != NULL) {
+                if (strlen(cp) + sizeof("/.tiprc") > sizeof(file)) {
+                        (void)fprintf(stderr, "Home directory path too long: %s\n",
+                            cp);
+                } else {
+                        snprintf(file, sizeof file, "%s/.tiprc", cp);
+                        if ((fp = fopen(file, "r")) != NULL) {
+                                char *tp;
+
+                                while (fgets(file, sizeof(file)-1, fp) != NULL) {
+                                        if (vflag)
+                                                printf("set %s", file);
+                                        if ((tp = strrchr(file, '\n')))
+                                                *tp = '\0';
+                                        vlex(file);
+                                }
+                                fclose(fp);
                         }
-                        fclose(fp);
                 }
         }
         /*

>Release-Note:
>Audit-Trail:
>Unformatted: