- reject files smaller or equal to two bytes, they are bogus
- fix out of bounds access in shargs() when n <= 2
- only copy the bytes read into line buffer
- use nil for pointers instead of 0
kstrdup(&elem, up->genbuf);
n = devtab[tc->type]->read(tc, &exec, sizeof(Exec), 0);
kstrdup(&elem, up->genbuf);
n = devtab[tc->type]->read(tc, &exec, sizeof(Exec), 0);
- magic = l2be(exec.magic);
- text = l2be(exec.text);
- entry = l2be(exec.entry);
- if(n==sizeof(Exec) && (magic == AOUT_MAGIC)){
+ if(n == sizeof(Exec) && (magic = l2be(exec.magic)) == AOUT_MAGIC){
+ text = l2be(exec.text);
+ entry = l2be(exec.entry);
switch(magic){
case S_MAGIC:
text += 8;
switch(magic){
case S_MAGIC:
text += 8;
- align = 0x200000ull; /* 2MB segment alignment for amd64 */
+ align = 0x200000; /* 2MB segment alignment for amd64 */
- align = 0x4000ull; /* MIPS has 16K page alignment */
+ align = 0x4000; /* MIPS has 16K page alignment */
break;
}
if(text >= (USTKTOP-USTKSIZE)-(UTZERO+sizeof(Exec))
break;
}
if(text >= (USTKTOP-USTKSIZE)-(UTZERO+sizeof(Exec))
/*
* Process #! /bin/sh args ...
*/
/*
* Process #! /bin/sh args ...
*/
- memmove(line, &exec, sizeof(Exec));
+ memmove(line, &exec, n);
if(indir || line[0]!='#' || line[1]!='!')
error(Ebadexec);
n = shargs(line, n, progarg);
if(indir || line[0]!='#' || line[1]!='!')
error(Ebadexec);
n = shargs(line, n, progarg);
error(Ebadexec);
indir = 1;
/*
* First arg becomes complete file name
*/
progarg[n++] = file;
error(Ebadexec);
indir = 1;
/*
* First arg becomes complete file name
*/
progarg[n++] = file;
argp0++;
file = progarg[0];
if(strlen(elem) >= sizeof progelem)
argp0++;
file = progarg[0];
if(strlen(elem) >= sizeof progelem)
s += 2;
n -= 2; /* skip #! */
s += 2;
n -= 2; /* skip #! */
- for(i=0; s[i]!='\n'; i++)
- if(i == n-1)
+ for(i=0;; i++){
+ if(i >= n)
+ if(s[i]=='\n')
+ break;
+ }
i = 0;
for(;;) {
while(*s==' ' || *s=='\t')
s++;
if(*s == 0)
break;
i = 0;
for(;;) {
while(*s==' ' || *s=='\t')
s++;
if(*s == 0)
break;
- i++;
- *ap++ = s;
- *ap = 0;
while(*s && *s!=' ' && *s!='\t')
s++;
if(*s == 0)
break;
while(*s && *s!=' ' && *s!='\t')
s++;
if(*s == 0)
break;