diff options
| author |   florian <florian@openbsd.org> | 2018-01-01 08:55:43 +0000 |
|---|---|---|
| committer | florian <florian@openbsd.org> | 2018-01-01 08:55:43 +0000 |
| commit | ff71d78866fbff3eb37f13bc1a32d895c969809d (patch) | |
| tree | 575f2544ca70760c2146da976e772719506ade82 /sys/kern/exec_script.c | |
| parent | copyright++; (diff) | |
| download | wireguard-openbsd-ff71d78866fbff3eb37f13bc1a32d895c969809d.tar.xz wireguard-openbsd-ff71d78866fbff3eb37f13bc1a32d895c969809d.zip | |
We are either allocating 2 or three array members. Unroll while loop
to be able to call free(9) with sizes.
off-by-one pointed out by guenther
OK visa
Diffstat (limited to 'sys/kern/exec_script.c')
| -rw-r--r-- | sys/kern/exec_script.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/sys/kern/exec_script.c b/sys/kern/exec_script.c index 0b9ae86e224..b6fd5be23d5 100644 --- a/sys/kern/exec_script.c +++ b/sys/kern/exec_script.c @@ -1,4 +1,4 @@ -/* $OpenBSD: exec_script.c,v 1.40 2017/02/11 19:51:06 guenther Exp $ */ +/* $OpenBSD: exec_script.c,v 1.41 2018/01/01 08:55:43 florian Exp $ */ /* $NetBSD: exec_script.c,v 1.13 1996/02/04 02:15:06 christos Exp $ */ /* @@ -264,11 +264,13 @@ fail: pool_put(&namei_pool, epp->ep_ndp->ni_cnd.cn_pnbuf); /* free the fake arg list, because we're not returning it */ - if ((tmpsap = shellargp) != NULL) { - while (*tmpsap != NULL) { - free(*tmpsap, M_EXEC, 0); - tmpsap++; - } + if (shellargp != NULL) { + free(shellargp[0], M_EXEC, shellnamelen + 1); + if (shellargp[2] != NULL) { + free(shellargp[1], M_EXEC, shellarglen + 1); + free(shellargp[2], M_EXEC, MAXPATHLEN); + } else + free(shellargp[1], M_EXEC, MAXPATHLEN); free(shellargp, M_EXEC, 4 * sizeof(char *)); } |