4 files changed, 16 insertions, 10 deletions

diff --git a/usr.bin/rdist/defs.h b/usr.bin/rdist/defs.h
index c99ddd60fc93..77dfcb9b934f 100644
--- a/usr.bin/rdist/defs.h
+++ b/usr.bin/rdist/defs.h
@@ -150,6 +150,7 @@ extern struct passwd *pw;	/* pointer to static area used by getpwent */
 extern struct group *gr;	/* pointer to static area used by getgrent */
 extern char host[];		/* host name of master copy */
 extern char buf[BUFSIZ];	/* general purpose buffer */
+extern char target[BUFSIZ];	/* target/source directory name */
 
 int	 any __P((int, char *));
 char	*colon __P((char *));
@@ -160,7 +161,7 @@ void	 error __P((const char *, ...));
 int	 except __P((char *));
 struct namelist *
 	 expand __P((struct namelist *, int));
-char	*exptilde __P((char [], char *));
+char	*exptilde __P((char [], char *, int));
 void	 fatal __P((const char *, ...));
 int	 inlist __P((struct namelist *, char *));
 void	 insert __P((char *,
diff --git a/usr.bin/rdist/docmd.c b/usr.bin/rdist/docmd.c
index b963e8bf64a6..07006f30cc1e 100644
--- a/usr.bin/rdist/docmd.c
+++ b/usr.bin/rdist/docmd.c
@@ -34,7 +34,7 @@
 #ifndef lint
 /*static char sccsid[] = "From: @(#)docmd.c	8.1 (Berkeley) 6/9/93";*/
 static const char rcsid[] =
-	"$Id: docmd.c,v 1.4 1996/07/12 04:00:13 nate Exp $";
+	"$Id: docmd.c,v 1.3.4.1 1996/07/12 06:19:46 pst Exp $";
 #endif /* not lint */
 
 #include "defs.h"
@@ -424,7 +424,7 @@ cmptime(name)
 	 * first time cmptime() is called?
 	 */
 	if (tp == NULL) {
-		if (exptilde(target, name) == NULL)
+		if (exptilde(target, name, sizeof(target)) == NULL)
 			return;
 		tp = name = target;
 		while (*tp)
diff --git a/usr.bin/rdist/expand.c b/usr.bin/rdist/expand.c
index 555dbf14776d..6e6d3b4ae147 100644
--- a/usr.bin/rdist/expand.c
+++ b/usr.bin/rdist/expand.c
@@ -618,13 +618,16 @@ addpath(c)
  * part corresponding to `file'.
  */
 char *
-exptilde(buf, file)
+exptilde(buf, file, maxlen)
 	char buf[];
 	register char *file;
+	int maxlen;
 {
 	register char *s1, *s2, *s3;
 	extern char homedir[];
 
+	if (strlen(file) >= maxlen)
+	   return(NULL);
 	if (*file != '~') {
 		strcpy(buf, file);
 		return(buf);
@@ -655,13 +658,15 @@ exptilde(buf, file)
 			*s3 = '/';
 		s2 = pw->pw_dir;
 	}
-	for (s1 = buf; *s1++ = *s2++; )
+	for (s1 = buf; (*s1++ = *s2++) && s1 < buf+maxlen; )
 		;
 	s2 = --s1;
-	if (s3 != NULL) {
+	if (s3 != NULL && s1 < buf+maxlen) {
 		s2++;
-		while (*s1++ = *s3++)
+		while ((*s1++ = *s3++) && s1 < buf+maxlen)
 			;
 	}
+	if (s1 == buf+maxlen)
+	   return(NULL);
 	return(s2);
 }
diff --git a/usr.bin/rdist/server.c b/usr.bin/rdist/server.c
index 46f3ea4b3bf8..62389f1eaa36 100644
--- a/usr.bin/rdist/server.c
+++ b/usr.bin/rdist/server.c
@@ -115,7 +115,7 @@ server()
 		case 't':  /* init target file/directory name */
 			catname = 0;
 		dotarget:
-			if (exptilde(target, cp) == NULL)
+			if (exptilde(target, cp, sizeof(target)) == NULL)
 				continue;
 			tp = target;
 			while (*tp)
@@ -176,7 +176,7 @@ server()
 				continue;
 			}
 			if (*cp == '~') {
-				if (exptilde(buf, cp) == NULL)
+				if (exptilde(buf, cp, sizeof(buf)) == NULL)
 					continue;
 				cp = buf;
 			}
@@ -248,7 +248,7 @@ install(src, dest, destdir, opts)
 			return;
 	}
 
-	rname = exptilde(target, src);
+	rname = exptilde(target, src, sizeof(target));
 	if (rname == NULL)
 		return;
 	tp = target;