add_implied_include() builds an implied "/**" filter rule from each transfer
argument the client sends, so the remote sender can validate the file list
against it. It under-counted a trailing backslash when sizing the buffer for
that rule, so the rule was written one byte past a heap allocation. The value
that overflows is supplied by the peer.

Demonstrated against a standard network rsync --daemon with a READ-ONLY
module: a remote, unauthenticated client sends -r --files-from=<file> with a
files-from entry carrying both an interior and a trailing backslash (a\b\),
and forward_filesfrom_data() feeds it to add_implied_include() on the daemon
side. The per-module parse_arguments() runs with am_server == 0, so
trust_sender_args stays 0 and the implied-include path is active.

A read-only module is enough; no write access and no crafted protocol are
needed. The write is one byte and its content is constrained, so code
execution is not claimed; heap corruption is, and the regression detects it as
an ASan heap-buffer-overflow.

Affected: 3.2.5 through 3.4.4 (add_implied_include() entered in 3.2.5)

Fixed in: 3.5.0 (part of the malicious-peer robustness work)

Reporter: Greg Kroah-Hartman (daemon-protocol fuzzing)

Test: exclude-implied-trailing-backslash