The branch main has been updated by jamie:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=6d9bc46cd7fc48ece597162d3ca413fc9d67b5f0

commit 6d9bc46cd7fc48ece597162d3ca413fc9d67b5f0
Author:     Jamie Gritton <[email protected]>
AuthorDate: 2026-07-01 18:36:08 +0000
Commit:     Jamie Gritton <[email protected]>
CommitDate: 2026-07-01 18:36:08 +0000

    jail: prevent a null derefence on array parameter assignment
    
    The same variable was used as a counter for an inner and out loop.
    Add a new one for the inner loop.
    
    PR:             283934
    Reported by:    crest at rlwinm.de
---
 usr.sbin/jail/config.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/usr.sbin/jail/config.c b/usr.sbin/jail/config.c
index 188f48732561..cc05c2916ca0 100644
--- a/usr.sbin/jail/config.c
+++ b/usr.sbin/jail/config.c
@@ -134,7 +134,7 @@ load_config(const char *cfname)
        struct cfparams opp;
        struct cfjail *j, *tj, *wj;
        struct cfparam *p, *vp, *tp;
-       struct cfstring *s, *vs, *ns;
+       struct cfstring *s, *vs, *ns, *cs;
        struct cfvar *v, *vv;
        char *ep;
        int did_self, jseq, pgen;
@@ -246,13 +246,14 @@ load_config(const char *cfname)
                                while ((vv = STAILQ_NEXT(vv, tq)))
                                        vv->pos += vs->len;
                                s->len += vs->len;
+                               cs = s;
                                while ((vs = TAILQ_NEXT(vs, tq))) {
                                        ns = emalloc(sizeof(struct cfstring));
                                        ns->s = estrdup(vs->s);
                                        ns->len = vs->len;
                                        STAILQ_INIT(&ns->vars);
-                                       TAILQ_INSERT_AFTER(&p->val, s, ns, tq);
-                                       s = ns;
+                                       TAILQ_INSERT_AFTER(&p->val, cs, ns, tq);
+                                       cs = ns;
                                }
                        free_var:
                                free(v->name);

Reply via email to