From: Matt Johnston <matt@ucc.asn.au>
Date: Mon, 1 Apr 2024 11:50:26 +0800
Subject: Handle arbitrary length paths and commands in
 multihop_passthrough_args()

Origin: https://github.com/mkj/dropbear/commit/2f1177e55f33afd676e08c9449ab7ab517fc3b30
Origin: https://github.com/mkj/dropbear/commit/697b1f86c0b2b0caf12e9e32bab29161093ab5d4
Origin: https://github.com/mkj/dropbear/commit/dd03da772bfad6174425066ff9752b60e25ed183
Origin: https://github.com/mkj/dropbear/commit/d59436a4d56de58b856142a5d489a4a8fc7382ed
---
 cli-runopts.c | 45 +++++++++++++++++++++++++--------------------
 1 file changed, 25 insertions(+), 20 deletions(-)

diff --git a/cli-runopts.c b/cli-runopts.c
index 38a73f7..632d097 100644
--- a/cli-runopts.c
+++ b/cli-runopts.c
@@ -528,56 +528,61 @@ static void loadidentityfile(const char* filename, int warnfail) {
 
 #if DROPBEAR_CLI_MULTIHOP
 
-static char*
-multihop_passthrough_args() {
-	char *ret;
+/* Fill out -i, -y, -W options that make sense for all
+ * the intermediate processes */
+static char* multihop_passthrough_args(void) {
+	char *args = NULL;
 	unsigned int len, total;
+#if DROPBEAR_CLI_PUBKEY_AUTH
 	m_list_elem *iter;
-	/* Fill out -i, -y, -W options that make sense for all
-	 * the intermediate processes */
-	len = 30; /* space for "-q -y -y -W <size>\0" */
+#endif
+	/* Sufficient space for non-string args */
+	len = 100;
+
+	/* String arguments have arbitrary length, so determine space required */
+	if (cli_opts.proxycmd) {
+		len += strlen(cli_opts.proxycmd);
+	}
 #if DROPBEAR_CLI_PUBKEY_AUTH
 	for (iter = cli_opts.privkeys->first; iter; iter = iter->next)
 	{
 		sign_key * key = (sign_key*)iter->item;
-		len += 3 + strlen(key->filename);
-	}
-#endif /* DROPBEAR_CLI_PUBKEY_AUTH */
-	if (cli_opts.proxycmd) {
-		/* "-J 'cmd'" */
-		len += 6 + strlen(cli_opts.proxycmd);
+		len += 4 + strlen(key->filename);
 	}
+#endif
 
-	ret = m_malloc(len);
+	args = m_malloc(len);
 	total = 0;
 
+	/* Create new argument string */
+
 	if (cli_opts.quiet) {
-		total += m_snprintf(ret+total, len-total, "-q ");
+		total += m_snprintf(args+total, len-total, "-q ");
 	}
 
 	if (cli_opts.no_hostkey_check) {
-		total += m_snprintf(ret+total, len-total, "-y -y ");
+		total += m_snprintf(args+total, len-total, "-y -y ");
 	} else if (cli_opts.always_accept_key) {
-		total += m_snprintf(ret+total, len-total, "-y ");
+		total += m_snprintf(args+total, len-total, "-y ");
 	}
 
 	if (cli_opts.proxycmd) {
-		total += m_snprintf(ret+total, len-total, "-J '%s' ", cli_opts.proxycmd);
+		total += m_snprintf(args+total, len-total, "-J '%s' ", cli_opts.proxycmd);
 	}
 
 	if (opts.recv_window != DEFAULT_RECV_WINDOW) {
-		total += m_snprintf(ret+total, len-total, "-W %u ", opts.recv_window);
+		total += m_snprintf(args+total, len-total, "-W %u ", opts.recv_window);
 	}
 
 #if DROPBEAR_CLI_PUBKEY_AUTH
 	for (iter = cli_opts.privkeys->first; iter; iter = iter->next)
 	{
 		sign_key * key = (sign_key*)iter->item;
-		total += m_snprintf(ret+total, len-total, "-i %s ", key->filename);
+		total += m_snprintf(args+total, len-total, "-i %s ", key->filename);
 	}
 #endif /* DROPBEAR_CLI_PUBKEY_AUTH */
 
-	return ret;
+	return args;
 }
 
 /* Sets up 'onion-forwarding' connections. This will spawn