misc/85696: xargs -E doesn't work

[Rici Lake]

>Number:         85696
>Category:       misc
>Synopsis:       xargs -E doesn't work
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Sep 03 18:10:10 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Rici Lake
>Release:        5.2; 4.10
>Organization:
Oxfam
>Environment:
>Description:
The -E argument to xargs does not work unless MALLOC_OPTIONS have been set to zero memory.
>How-To-Repeat:
This should echo "one"):
echo $'one\ntwo\nthree' | xargs -E two echo

It works with MALLOC_OPTIONS=Z and fails with MALLOC_OPTIONS=J

-bash-2.05b$ echo $'one\ntwo\nthree' | MALLOC_OPTIONS=J xargs -E two echo
one two three
-bash-2.05b$ echo $'one\ntwo\nthree' | MALLOC_OPTIONS=Z xargs -E two echo
one


>Fix:
      Lines 293-298 of xargs.c (revision 1.55.2.1)
The test at line 295 is testing the buffer currently being constructed with the -E option argument (eofstr). Since the buffer has not been NUL-terminated, this will only produce the correct answer by accident (indeed, it could run off and read unallocated memory if the -E string were long enough)

*p should zapped before the compare is done, rather than at line 299. (Although I haven't traced through the execution path in full; I assume zapping *p at this point does no harm, but a full analysis is necessary.)

 293: arg2:
 294:                foundeof = *eofstr != '\0' &&
 295:                    strcmp(argp, eofstr) == 0;
 296:
 297:                /* Do not make empty args unless they are quoted */
 298:                if ((argp != p || wasquoted) && !foundeof) {
 299:                        *p++ = '\0';

>Release-Note:
>Audit-Trail:
>Unformatted: