fuse_session_new(): don't accept empty argv, check argv[0]

This should help avoid people to accidentally put options
into argv[0].

Fixes #100.

2 files changed, 19 insertions, 5 deletions

diff --git a/include/fuse.h b/include/fuse.h
index e8ff936..312818e 100644
--- a/include/fuse.h
+++ b/include/fuse.h
@@ -748,11 +748,13 @@ struct fuse_context {
  * fuse_main() accepts all options that can be passed to
  * fuse_parse_cmdline(), fuse_new(), or fuse_session_new().
  *
- * Normally, fuse_main() includes a basic ``usage: `` message in the
- * --help output. However, if argv[0] is an empty string, the usage
- * message is suppressed. This can be used by file systems to print
- * their own usage line first. See hello.c for an example of how to do
- * this.
+ * Option parsing skips argv[0], which is assumed to contain the
+ * program name. This element must always be present and is used to
+ * construct a basic ``usage: `` message for the --help
+ * output. argv[0] may also be set to the empty string. In this case
+ * the usage message is suppressed. This can be used by file systems
+ * to print their own usage line first. See hello.c for an example of
+ * how to do this.
  *
  * Note: this is currently implemented as a macro.
  *
@@ -785,6 +787,12 @@ struct fuse_context {
  * If the --help option is specified, the function writes a help text
  * to stdout and returns NULL.
  *
+ * Option parsing skips argv[0], which is assumed to contain the
+ * program name. This element must always be present and is used to
+ * construct a basic ``usage: `` message for the --help output. If
+ * argv[0] is set to the empty string, no usage message is included in
+ * the --help output.
+ *
  * If an unknown option is passed in, an error message is written to
  * stderr and the function returns NULL.
  *
diff --git a/include/fuse_lowlevel.h b/include/fuse_lowlevel.h
index 8ec95b5..e6f95a9 100644
--- a/include/fuse_lowlevel.h
+++ b/include/fuse_lowlevel.h
@@ -1655,6 +1655,12 @@ int fuse_parse_cmdline(struct fuse_args *args,
  * If not all options are known, an error message is written to stderr
  * and the function returns NULL.
  *
+ * Option parsing skips argv[0], which is assumed to contain the
+ * program name. To prevent accidentially passing an option in
+ * argv[0], this element must always be present (even if no options
+ * are specified). It may be set to the empty string ('\0') if no
+ * reasonable value can be provided.
+ *
  * @param args argument vector
  * @param op the (low-level) filesystem operations
  * @param op_size sizeof(struct fuse_lowlevel_ops)