UTIL: Fix access out of bound in parse_args

While parsing string with multiple whitespaces, it may happen variable i is
zero and we want to test end of argument "tmp[i-1] != '\0'". Side effect of
this bug is duplicite string output array.
  Input string:    "foo  b"
  Expected output: { "foo", "a", NULL }
  Output:          { "foo", "foo", "a", NULL }

This patch uses inverted logic. Instead of testing whether to read next char or
skip multiple whitespaces, we will test whether we have new argument which
should be stored in output array.

Reviewed-by: Pavel Reichl <preichl@redhat.com>
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

1 files changed, 13 insertions, 13 deletions

diff --git a/src/util/util.c b/src/util/util.c
index ad93ca1a0..7f80771ec 100644
--- a/src/util/util.c
+++ b/src/util/util.c
@@ -153,7 +153,8 @@ char **parse_args(const char *str)
     num = 0;
     i = 0;
     e = false;
-    w = false;
+    /* skip leading whitespaces */
+    w = true;
     p = str;
     while (*p) {
         if (*p == '\\') {
@@ -205,19 +206,18 @@ char **parse_args(const char *str)
             tmp[i] = '\0';
             i++;
         }
-        if (tmp[i-1] != '\0' || strlen(tmp) == 0) {
-            /* check next char and skip multiple spaces */
-            continue;
-        }
 
-        r = realloc(ret, (num + 2) * sizeof(char *));
-        if (!r) goto fail;
-        ret = r;
-        ret[num+1] = NULL;
-        ret[num] = strdup(tmp);
-        if (!ret[num]) goto fail;
-        num++;
-        i = 0;
+        /* save token to result array */
+        if (i > 1 && tmp[i-1] == '\0') {
+            r = realloc(ret, (num + 2) * sizeof(char *));
+            if (!r) goto fail;
+            ret = r;
+            ret[num+1] = NULL;
+            ret[num] = strdup(tmp);
+            if (!ret[num]) goto fail;
+            num++;
+            i = 0;
+        }
     }
 
     free(tmp);