Re: Possible bug in lib/libc/gen/exec.c

[Alejandro Colomar (man-pages)]

Hello Theo,

On 9/16/21 10:53 PM, Theo de Raadt wrote:

@@ -45,25 +46,31 @@ execl(const char *name, const char *arg,
  {
        va_list ap;
        char **argv;
-       int n;
+       size_t maplen;
+       int save_errno, n, error;

See below.

va_start(ap, arg);

        n = 1;
        while (va_arg(ap, char *) != NULL)
                n++;
        va_end(ap);
-       argv = alloca((n + 1) * sizeof(*argv));
-       if (argv == NULL) {
-               errno = ENOMEM;
+       maplen = (n + 1) * sizeof(*argv);
+       argv = mmap(NULL, maplen, PROT_WRITE|PROT_READ,
+           MAP_ANON|MAP_PRIVATE, -1, 0);
+       if (argv == MAP_FAILED)
                return (-1);
-       }
        va_start(ap, arg);
        n = 1;
        argv[0] = (char *)arg;
        while ((argv[n] = va_arg(ap, char *)) != NULL)
                n++;
        va_end(ap);
-       return (execve(name, argv, environ));
+
+       error = execve(name, argv, environ);
+       save_errno = errno;
+       munmap(argv, maplen);
+       errno = save_errno;
+       return (error);

This part could be simplified to:

        (void) execve(name, argv, environ);
        save_errno = errno;
        munmap(argv, maplen);
        errno = save_errno;
        return -1;

Allowing to remove the error variable.  execve(2) always returns -1.

  }
  DEF_WEAK(execl);

@@ -72,18 +79,21 @@ execle(const char *name, const char *arg

  {
        va_list ap;
        char **argv, **envp;
-       int n;
+       size_t maplen;
+       int save_errno, n, error;

Same here.

@@ -91,7 +101,12 @@ execle(const char *name, const char *arg
                n++;
        envp = va_arg(ap, char **);
        va_end(ap);
-       return (execve(name, argv, envp));
+
+       error = execve(name, argv, envp);
+       save_errno = errno;
+       munmap(argv, maplen);
+       errno = save_errno;
+       return error;

Same here

@@ -99,25 +114,32 @@ execlp(const char *name, const char *arg
  {
        va_list ap;
        char **argv;
-       int n;
+       size_t maplen;
+       int save_errno, n, error;

Same here.



--
Alejandro Colomar
Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/
http://www.alejandro-colomar.es/