From a955fee8e757ee22a5e48c29f5790bfb048e0955 Mon Sep 17 00:00:00 2001
From: Fred Gleason <fredg@paravelsystems.com>
Date: Thu, 12 Mar 2020 17:38:38 -0400
Subject: [PATCH] 2020-03-12 Fred Gleason <fredg@paravelsystems.com> 	*
 Fixed a race in ripcd(8) that caused arguments to the 	'Run Shell Command'
 ['RN'] macro to be corrupted.

---
 ChangeLog              |  3 +++
 ripcd/local_macros.cpp | 35 +++++++++++++++++++++++++++++++----
 2 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index ef92e62a..760ae12c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -19735,3 +19735,6 @@
 	to schema 297.
 2020-03-12 Fred Gleason <fredg@paravelsystems.com>
 	* Incremented the package version to v3.2.1int4.
+2020-03-12 Fred Gleason <fredg@paravelsystems.com>
+	* Fixed a race in ripcd(8) that caused arguments to the
+	'Run Shell Command' ['RN'] macro to be corrupted.
diff --git a/ripcd/local_macros.cpp b/ripcd/local_macros.cpp
index 3d1acff1..d76de8ff 100644
--- a/ripcd/local_macros.cpp
+++ b/ripcd/local_macros.cpp
@@ -1066,20 +1066,47 @@ RDMacro MainObject::ForwardConvert(const RDMacro &rml) const
 void MainObject::RunCommand(const QString &user,const QString &group,
 			    const QString &cmd) const
 {
+  //
+  // Maintainer's Note: Everything passed to execv() must be either in
+  //                    local or heap storage. *Don't* pass (const char *)
+  //                    references from Qt directly!
+  //
+
+  //
+  // Build the command
+  //
   QStringList f0=cmd.split(" ",QString::SkipEmptyParts);
+  char userarg[256];
+  strncpy(userarg,user.toUtf8().constData(),255);
+  char grouparg[256];
+  strncpy(grouparg,group.toUtf8().constData(),255);
   const char *args[f0.size()+6];
   args[0]=RD_RUNUSER;
   args[1]="-u";
-  args[2]=user.toUtf8();
+  args[2]=userarg;
   args[3]="-g";
-  args[4]=group.toUtf8();
+  args[4]=grouparg;
+  QList<char *> rargs;
   for(int i=0;i<f0.size();i++) {
-    args[5+i]=f0.at(i).toUtf8();
+    rargs.push_back((char *)malloc(f0.at(i).toUtf8().length()+1));
+    strcpy(rargs.back(),f0.at(i).toUtf8());
+    args[5+i]=rargs.back();
   }
   args[5+f0.size()]=(char *)NULL;
+
+  //
+  // Run it
+  //
   if(vfork()==0) {
     execv(RD_RUNUSER,(char * const *)args);
-    exit(0);
+    exit(0);  // Just in case...
+  }
+
+  //
+  // Free the heap storage
+  //
+  for(int i=0;i<rargs.size();i++) {
+    free(rargs.at(i));
   }
 }