comm: close a race condition when comm is fed from stdin

If one of the files has ended, we won't show the column, but we still
need to drain the file pointer to avoid potentially hitting a pipe
failure.

This commit moves the NULL offset checks inside show() so that getline()
and ferror() are still called on fp.

Reviewed by:	allanjude
Sponsored by:	Apple Inc.
Differential Revision:	https://reviews.freebsd.org/D45440

1 files changed, 6 insertions, 4 deletions

diff --git a/usr.bin/comm/comm.c b/usr.bin/comm/comm.c
index 2f305e23ce8f..4dcd7cc9a2dd 100644
--- a/usr.bin/comm/comm.c
+++ b/usr.bin/comm/comm.c
@@ -129,12 +129,12 @@ main(int argc, char *argv[])
 
 		/* if one file done, display the rest of the other file */
 		if (n1 < 0) {
-			if (n2 >= 0 && col2 != NULL)
+			if (n2 >= 0)
 				show(fp2, argv[1], col2, &line2, &line2len);
 			break;
 		}
 		if (n2 < 0) {
-			if (n1 >= 0 && col1 != NULL)
+			if (n1 >= 0)
 				show(fp1, argv[0], col1, &line1, &line1len);
 			break;
 		}
@@ -206,10 +206,12 @@ show(FILE *fp, const char *fn, const char *offset, char **bufp, size_t *buflenp)
 	ssize_t n;
 
 	do {
-		(void)printf("%s%s\n", offset, *bufp);
+		/* offset is NULL when draining fp, not printing */
+		if (offset != NULL)
+			(void)printf("%s%s\n", offset, *bufp);
 		if ((n = getline(bufp, buflenp, fp)) < 0)
 			break;
-		if (n > 0 && (*bufp)[n - 1] == '\n')
+		if (n > 0 && offset != NULL && (*bufp)[n - 1] == '\n')
 			(*bufp)[n - 1] = '\0';
 	} while (1);
 	if (ferror(fp))