The branch main has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=6d9bc46cd7fc48ece597162d3ca413fc9d67b5f0
commit 6d9bc46cd7fc48ece597162d3ca413fc9d67b5f0 Author: Jamie Gritton <[email protected]> AuthorDate: 2026-07-01 18:36:08 +0000 Commit: Jamie Gritton <[email protected]> CommitDate: 2026-07-01 18:36:08 +0000 jail: prevent a null derefence on array parameter assignment The same variable was used as a counter for an inner and out loop. Add a new one for the inner loop. PR: 283934 Reported by: crest at rlwinm.de --- usr.sbin/jail/config.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/usr.sbin/jail/config.c b/usr.sbin/jail/config.c index 188f48732561..cc05c2916ca0 100644 --- a/usr.sbin/jail/config.c +++ b/usr.sbin/jail/config.c @@ -134,7 +134,7 @@ load_config(const char *cfname) struct cfparams opp; struct cfjail *j, *tj, *wj; struct cfparam *p, *vp, *tp; - struct cfstring *s, *vs, *ns; + struct cfstring *s, *vs, *ns, *cs; struct cfvar *v, *vv; char *ep; int did_self, jseq, pgen; @@ -246,13 +246,14 @@ load_config(const char *cfname) while ((vv = STAILQ_NEXT(vv, tq))) vv->pos += vs->len; s->len += vs->len; + cs = s; while ((vs = TAILQ_NEXT(vs, tq))) { ns = emalloc(sizeof(struct cfstring)); ns->s = estrdup(vs->s); ns->len = vs->len; STAILQ_INIT(&ns->vars); - TAILQ_INSERT_AFTER(&p->val, s, ns, tq); - s = ns; + TAILQ_INSERT_AFTER(&p->val, cs, ns, tq); + cs = ns; } free_var: free(v->name);
