[PATCH] Fix writes past the allocated array bounds in execvpe (BZ# 20847)

[Andreas Schwab]

On Nov 21 2016, Dominik Vogt <vogt@linux.vnet.ibm.com> wrote:

>> diff --git a/posix/execvpe.c b/posix/execvpe.c
>> index d933f9c..bd535b1 100644
>> --- a/posix/execvpe.c
>> +++ b/posix/execvpe.c
>> @@ -41,15 +41,16 @@ maybe_script_execute (const char *file, char *const argv[], char *const envp[])
>>    ptrdiff_t argc = 0;
>>    while (argv[argc++] != NULL)
>
> This loop is broken.  It calculates the wrong value; if there are
> three arguments, argc will be 4. (See patch below).

This is intented, it computes the new argc.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."