Description: fix incomplete/unsafe initialization of ARGV array
Author:  Ethan A Merritt
Origin: https://sourceforge.net/p/gnuplot/gnuplot-main/ci/732014eefd41235a143626d2bc02d3d34934e1b3/
Bug-Debian: https://bugs.debian.org/926658
Bug: https://sourceforge.net/p/gnuplot/bugs/2115/


Index: gnuplot-5.2.6+dfsg1/src/misc.c
===================================================================
--- gnuplot-5.2.6+dfsg1.orig/src/misc.c
+++ gnuplot-5.2.6+dfsg1/src/misc.c
@@ -239,6 +239,7 @@ prepare_call(int calltype)
     udv->udv_value.type = ARRAY;
     ARGV = udv->udv_value.v.value_array = gp_alloc((argv_size + 1) * sizeof(t_value), "array state");
     ARGV[0].v.int_val = argv_size;
+    ARGV[0].type = NOTDEFINED;
 
     for (argindex = 1; argindex <= 9; argindex++) {
 	char *argstring = call_args[argindex-1];
@@ -586,9 +587,14 @@ lf_push(FILE *fp, char *name, char *cmdl
 	}
 	/* Save ARGV[] */
 	lf->argv[0].v.int_val = 0;
+	lf->argv[0].type = NOTDEFINED;
 	if ((udv = get_udv_by_name("ARGV")) && udv->udv_value.type == ARRAY) {
-	    for (argindex = 0; argindex <= call_argc; argindex++)
+	    for (argindex = 0; argindex <= call_argc; argindex++) {
 		lf->argv[argindex] = udv->udv_value.v.value_array[argindex];
+		if (lf->argv[argindex].type == STRING)
+		    lf->argv[argindex].v.string_val =
+			gp_strdup(lf->argv[argindex].v.string_val);
+	    }
 	}
     }
     lf->depth = lf_head ? lf_head->depth+1 : 0;	/* recursion depth */
Index: gnuplot-5.2.6+dfsg1/src/plot.c
===================================================================
--- gnuplot-5.2.6+dfsg1.orig/src/plot.c
+++ gnuplot-5.2.6+dfsg1/src/plot.c
@@ -1,7 +1,3 @@
-#ifndef lint
-static char *RCSid() { return RCSid("$Id: plot.c,v 1.174 2017/05/20 16:43:19 markisch Exp $"); }
-#endif
-
 /* GNUPLOT - plot.c */
 
 /*[
@@ -638,10 +634,11 @@ RECOVER_FROM_ERROR_IN_DASH:
 		    fprintf(stderr, "syntax:  gnuplot -c scriptname args\n");
 		    gp_exit(EXIT_FAILURE);
 		}
-		for (i=0; i<argc; i++)
+		call_argc = GPMIN(9, argc - 1);
+		for (i=0; i<=call_argc; i++) {
 		    /* Need to stash argv[i] somewhere visible to load_file() */
 		    call_args[i] = gp_strdup(argv[i+1]);
-		call_argc = argc - 1;
+		}
 
 		load_file(loadpath_fopen(*argv, "r"), gp_strdup(*argv), 5);
 		gp_exit(EXIT_SUCCESS);