diff options
| author | Florian Obser <florian@cvs.openbsd.org> | 2018-01-01 08:55:44 +0000 |
|---|---|---|
| committer | Florian Obser <florian@cvs.openbsd.org> | 2018-01-01 08:55:44 +0000 |
| commit | 197764ea5614a31970f5e47005cfea8e169b1d33 (patch) | |
| tree | ab3c0f0bfcb24c713b0b9beb4fc1faa96362b8ac | |
| parent | 3885cd79b0744f17bb8c6fc6cade5005052760b5 (diff) | |
We are either allocating 2 or three array members. Unroll while loop
to be able to call free(9) with sizes.
off-by-one pointed out by guenther
OK visa
| -rw-r--r-- | sys/kern/exec_script.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/sys/kern/exec_script.c b/sys/kern/exec_script.c index 0b9ae86e224..b6fd5be23d5 100644 --- a/sys/kern/exec_script.c +++ b/sys/kern/exec_script.c @@ -1,4 +1,4 @@ -/* $OpenBSD: exec_script.c,v 1.40 2017/02/11 19:51:06 guenther Exp $ */ +/* $OpenBSD: exec_script.c,v 1.41 2018/01/01 08:55:43 florian Exp $ */ /* $NetBSD: exec_script.c,v 1.13 1996/02/04 02:15:06 christos Exp $ */ /* @@ -264,11 +264,13 @@ fail: pool_put(&namei_pool, epp->ep_ndp->ni_cnd.cn_pnbuf); /* free the fake arg list, because we're not returning it */ - if ((tmpsap = shellargp) != NULL) { - while (*tmpsap != NULL) { - free(*tmpsap, M_EXEC, 0); - tmpsap++; - } + if (shellargp != NULL) { + free(shellargp[0], M_EXEC, shellnamelen + 1); + if (shellargp[2] != NULL) { + free(shellargp[1], M_EXEC, shellarglen + 1); + free(shellargp[2], M_EXEC, MAXPATHLEN); + } else + free(shellargp[1], M_EXEC, MAXPATHLEN); free(shellargp, M_EXEC, 4 * sizeof(char *)); } |