| @@ -1120,27 +1120,27 @@ E protocol error: directory '%s' not wit | | | @@ -1120,27 +1120,27 @@ E protocol error: directory '%s' not wit |
1120 | * directory via "..". | | 1120 | * directory via "..". |
1121 | */ | | 1121 | */ |
1122 | static void | | 1122 | static void |
1123 | serve_max_dotdot (char *arg) | | 1123 | serve_max_dotdot (char *arg) |
1124 | { | | 1124 | { |
1125 | int lim = atoi (arg); | | 1125 | int lim = atoi (arg); |
1126 | int i; | | 1126 | int i; |
1127 | char *p; | | 1127 | char *p; |
1128 | | | 1128 | |
1129 | #ifdef PROXY_SUPPORT | | 1129 | #ifdef PROXY_SUPPORT |
1130 | if (proxy_log) return; | | 1130 | if (proxy_log) return; |
1131 | #endif /* PROXY_SUPPORT */ | | 1131 | #endif /* PROXY_SUPPORT */ |
1132 | | | 1132 | |
1133 | if (lim < 0 || lim > 10000) | | 1133 | if (lim < 0 || lim > 1000000) |
1134 | return; | | 1134 | return; |
1135 | p = xmalloc (strlen (server_temp_dir) + 2 * lim + 10); | | 1135 | p = xmalloc (strlen (server_temp_dir) + 2 * lim + 10); |
1136 | if (p == NULL) | | 1136 | if (p == NULL) |
1137 | { | | 1137 | { |
1138 | pending_error = ENOMEM; | | 1138 | pending_error = ENOMEM; |
1139 | return; | | 1139 | return; |
1140 | } | | 1140 | } |
1141 | strcpy (p, server_temp_dir); | | 1141 | strcpy (p, server_temp_dir); |
1142 | for (i = 0; i < lim; ++i) | | 1142 | for (i = 0; i < lim; ++i) |
1143 | strcat (p, "/d"); | | 1143 | strcat (p, "/d"); |
1144 | if (server_temp_dir != orig_server_temp_dir) | | 1144 | if (server_temp_dir != orig_server_temp_dir) |
1145 | free (server_temp_dir); | | 1145 | free (server_temp_dir); |
1146 | server_temp_dir = p; | | 1146 | server_temp_dir = p; |
| @@ -2979,27 +2979,27 @@ server_notify (void) | | | @@ -2979,27 +2979,27 @@ server_notify (void) |
2979 | | | 2979 | |
2980 | /* This request is processed in all passes since requests which must | | 2980 | /* This request is processed in all passes since requests which must |
2981 | * sometimes be processed before it is known whether we are running as a | | 2981 | * sometimes be processed before it is known whether we are running as a |
2982 | * secondary or not, for instance the `expand-modules' request, sometimes use | | 2982 | * secondary or not, for instance the `expand-modules' request, sometimes use |
2983 | * the `Arguments'. | | 2983 | * the `Arguments'. |
2984 | */ | | 2984 | */ |
2985 | static void | | 2985 | static void |
2986 | serve_argument (char *arg) | | 2986 | serve_argument (char *arg) |
2987 | { | | 2987 | { |
2988 | char *p; | | 2988 | char *p; |
2989 | | | 2989 | |
2990 | if (error_pending()) return; | | 2990 | if (error_pending()) return; |
2991 | | | 2991 | |
2992 | if (argument_count >= 10000) | | 2992 | if (argument_count >= 1000000) |
2993 | { | | 2993 | { |
2994 | if (alloc_pending (80)) | | 2994 | if (alloc_pending (80)) |
2995 | sprintf (pending_error_text, | | 2995 | sprintf (pending_error_text, |
2996 | "E Protocol error: too many arguments"); | | 2996 | "E Protocol error: too many arguments"); |
2997 | return; | | 2997 | return; |
2998 | } | | 2998 | } |
2999 | | | 2999 | |
3000 | if (argument_vector_size <= argument_count) | | 3000 | if (argument_vector_size <= argument_count) |
3001 | { | | 3001 | { |
3002 | argument_vector_size *= 2; | | 3002 | argument_vector_size *= 2; |
3003 | argument_vector = xnrealloc (argument_vector, | | 3003 | argument_vector = xnrealloc (argument_vector, |
3004 | argument_vector_size, sizeof (char *)); | | 3004 | argument_vector_size, sizeof (char *)); |
3005 | if (argument_vector == NULL) | | 3005 | if (argument_vector == NULL) |