From cdcaf21acd08a8dd1b3806e0f4e9de5eaf0184b7 Mon Sep 17 00:00:00 2001
From: TapTap <taptap.programming@gmail.com>
Date: Wed, 9 Sep 2026 14:23:59 +0200
Subject: [PATCH] fix(p5-rsh): NULL-check argv tail str_dups in
 ssh_build_client_argv

---
 src/shared/transport_ssh.c | 34 ++++++++++++++++++++++++++++------
 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/src/shared/transport_ssh.c b/src/shared/transport_ssh.c
index fe3c18e..f3c7709 100644
--- a/src/shared/transport_ssh.c
+++ b/src/shared/transport_ssh.c
@@ -189,18 +189,40 @@ char** ssh_build_client_argv(const char* rsh_command, int port, const char* user
   char* tail[] = {"-o", "Compression=no",
                   "-o", "ControlMaster=auto",
                   "-o", "ControlPath=~/.cache/fastsync-%r@%h:%p"};
-  for (size_t i = 0; i < sizeof(tail) / sizeof(tail[0]); i++)
-    argv[ac++] = str_dup(tail[i]);
+  for (size_t i = 0; i < sizeof(tail) / sizeof(tail[0]); i++) {
+    argv[ac] = str_dup(tail[i]);
+    if (!argv[ac])
+      goto fail_argv;
+    ac++;
+  }
   if (port_extra) {
     char port_str[16];
     snprintf(port_str, sizeof(port_str), "%d", port);
-    argv[ac++] = str_dup("-p");
-    argv[ac++] = str_dup(port_str);
+    argv[ac] = str_dup("-p");
+    if (!argv[ac])
+      goto fail_argv;
+    ac++;
+    argv[ac] = str_dup(port_str);
+    if (!argv[ac])
+      goto fail_argv;
+    ac++;
   }
-  argv[ac++] = str_dup(userhost);
-  argv[ac++] = str_dup(remote_command);
+  argv[ac] = str_dup(userhost);
+  if (!argv[ac])
+    goto fail_argv;
+  ac++;
+  argv[ac] = str_dup(remote_command);
+  if (!argv[ac])
+    goto fail_argv;
+  ac++;
   argv[ac] = NULL;
   return argv;
+
+fail_argv:
+  for (int i = 0; i < ac; i++)
+    free(argv[i]);
+  free(argv);
+  return NULL;
 }
 
 void ssh_free_client_argv(char** argv) {