[src/trunk]: src/sys/kern CID/1427732: Don't dereference NULL execname if the...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5f1e321f44bb
branches:  trunk
changeset: 321460:5f1e321f44bb
user:      christos <christos%NetBSD.org@localhost>
date:      Sat Mar 17 00:30:50 2018 +0000

description:
CID/1427732: Don't dereference NULL execname if there is no emul_arg.
(there always is one in our emulations) from alnsn@

diffstat:

 sys/kern/exec_elf.c |  23 ++++++++++++++---------
 1 files changed, 14 insertions(+), 9 deletions(-)

diffs (58 lines):

diff -r d29aae454f6a -r 5f1e321f44bb sys/kern/exec_elf.c
--- a/sys/kern/exec_elf.c       Sat Mar 17 00:28:03 2018 +0000
+++ b/sys/kern/exec_elf.c       Sat Mar 17 00:30:50 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: exec_elf.c,v 1.93 2017/11/07 19:44:04 christos Exp $   */
+/*     $NetBSD: exec_elf.c,v 1.94 2018/03/17 00:30:50 christos Exp $   */
 
 /*-
  * Copyright (c) 1994, 2000, 2005, 2015 The NetBSD Foundation, Inc.
@@ -57,7 +57,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(1, "$NetBSD: exec_elf.c,v 1.93 2017/11/07 19:44:04 christos Exp $");
+__KERNEL_RCSID(1, "$NetBSD: exec_elf.c,v 1.94 2018/03/17 00:30:50 christos Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_pax.h"
@@ -161,7 +161,6 @@
                return error;
 
        a = ai;
-       execname = NULL;
 
        memset(ai, 0, sizeof(ai));
 
@@ -231,6 +230,8 @@
                a++;
 
                exec_free_emul_arg(pack);
+       } else {
+               execname = NULL;
        }
 
        a->a_type = AT_NULL;
@@ -241,12 +242,16 @@
 
        KASSERT(vlen <= sizeof(ai));
 
-       char *path = l->l_proc->p_path;
-       execname->a_v = (uintptr_t)(*stackp + vlen);
-       len = strlen(path) + 1;
-       if ((error = copyout(path, (*stackp + vlen), len)) != 0)
-               return error;
-       len = ALIGN(len);
+       if (execname) {
+               char *path = l->l_proc->p_path;
+               execname->a_v = (uintptr_t)(*stackp + vlen);
+               len = strlen(path) + 1;
+               if ((error = copyout(path, (*stackp + vlen), len)) != 0)
+                       return error;
+               len = ALIGN(len);
+       } else {
+               len = 0;
+       }
 
        if ((error = copyout(ai, *stackp, vlen)) != 0)
                return error;