From 302a58881237f142bd4e1295e30f3a5008ad836a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Thu, 27 Oct 2022 16:29:52 +0800
Subject: [PATCH] TerminalShell: fix shellExe detection on macOS

`proc_pidpath()` works only if bufsize >= PROC_PIDPATHINFO_MAXSIZE
---
 src/detection/terminalshell/terminalshell_linux.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c
index 5040cede5..79e383bd4 100644
--- a/src/detection/terminalshell/terminalshell_linux.c
+++ b/src/detection/terminalshell/terminalshell_linux.c
@@ -313,13 +313,21 @@ const FFTerminalShellResult* ffDetectTerminalShell(const FFinstance* instance)
     }
     init = true;
 
+    #ifdef __APPLE__
+    const uint32_t exePathLen = PROC_PIDPATHINFO_MAXSIZE;
+    #elif defined(MAXPATH)
+    const uint32_t exePathLen = MAXPATH;
+    #else
+    const uint32_t exePathLen = 260;
+    #endif
+
     ffStrbufInit(&result.shellProcessName);
-    ffStrbufInitA(&result.shellExe, 128);
+    ffStrbufInitA(&result.shellExe, exePathLen);
     result.shellExeName = result.shellExe.chars;
     ffStrbufInit(&result.shellVersion);
 
     ffStrbufInit(&result.terminalProcessName);
-    ffStrbufInitA(&result.terminalExe, 128);
+    ffStrbufInitA(&result.terminalExe, exePathLen);
     result.terminalExeName = result.terminalExe.chars;
 
     ffStrbufInit(&result.userShellExe);