From b81d7e37bbf1f4bf92281bcb00e9930f824646d8 Mon Sep 17 00:00:00 2001
From: David Greenman <dg@FreeBSD.org>
Date: Mon, 27 Apr 1998 10:51:26 +0000
Subject: [PATCH] Fixed a bug where if MAXUSRARGS amount of args were passed
 in, the argv[] array would end up without the NULL pointer termination,
 causing the glob code to glob whatever garbage happend to follow on the
 stack.

---
 libexec/ftpd/popen.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libexec/ftpd/popen.c b/libexec/ftpd/popen.c
index 47534d525be..4996c257ee2 100644
--- a/libexec/ftpd/popen.c
+++ b/libexec/ftpd/popen.c
@@ -39,7 +39,7 @@
 static char sccsid[] = "@(#)popen.c	8.3 (Berkeley) 4/6/94";
 #endif
 static const char rcsid[] =
-	"$Id: popen.c,v 1.9 1997/11/21 07:38:43 charnier Exp $";
+	"$Id: popen.c,v 1.10 1998/02/25 07:10:57 danny Exp $";
 #endif /* not lint */
 
 #include <sys/types.h>
@@ -94,9 +94,11 @@ ftpd_popen(program, type)
 		return (NULL);
 
 	/* break up string into pieces */
-	for (argc = 0, cp = program; argc < MAXUSRARGS; cp = NULL)
+	for (argc = 0, cp = program; argc < MAXUSRARGS; cp = NULL) {
 		if (!(argv[argc++] = strtok(cp, " \t\n")))
 			break;
+	}
+	argv[argc - 1] = NULL;
 
 	/* glob each piece */
 	gargv[0] = argv[0];