Larry suggested using concat_path_file() would be an even safer bet

for 'which'.  I ageed, so I whipped this up -- which revealed a bug in
concat_path_file.  It turns out that that a '/' can be appended from
either the path _or_ the filename, but only the former was checked.
 -Erik

1 files changed, 3 insertions, 4 deletions

diff --git a/findutils/which.c b/findutils/which.c
index 08813c1..1e5e9ee 100644
--- a/findutils/which.c
+++ b/findutils/which.c
@@ -53,10 +53,9 @@ extern int which_main(int argc, char **argv)
 		argv++;
 		found = 0;
 		for (i = 0; i < count; i++) {
-			char buf[strlen(path_n)+strlen(*argv)+2];
-			strcpy (buf, path_n);
-			strcat (buf, "/");
-			strcat (buf, *argv);
+			char *buf;
+			buf = concat_path_file(buf, path_n);
+			buf = concat_path_file(buf, *argv);
 			if (stat (buf, &filestat) == 0
 			    && filestat.st_mode & S_IXUSR)
 			{