knox
knox copied to clipboard
Handle args / env over max expected size
It seems that the count of the args can sometimes exceed the AUDIT_MAX_ARGS, eventually resulting in a crash / asan violation when calling strchr on the string. This makes sure that commands doesn't crash, but realistically this can mean some args are ignored in the final output. It seems like this is the best we can do in this case.
This case is easy to test because with a single clang /tmp/foo.c
invocation the underlying -cc1
invocation is over 128 args.