cvs commit: src/sys/kern kern_exec.c

[Paul Saab]

ps          2005-10-09 17:28:13 UTC

  FreeBSD src repository

  Modified files:        (Branch: RELENG_6)
    sys/kern             kern_exec.c 
  Log:
  MFC:
  > revision 1.277
  > date: 2005/10/03 12:49:54;  author: cperciva;  state: Exp;  lines: +8 -0
  > If sufficiently bad things happen during a call to kern_execve(), it is
  > possible for do_execve() to call exit1() rather than returning.  As a
  > result, the sequence "allocate memory; call kern_execve; free memory"
  > can end up leaking memory.
  >
  > This commit documents this astonishing behaviour and adds a call to
  > exec_free_args() before the exit1() call in do_execve().  Since all
  > the users of kern_execve() in the tree use exec_free_args() to free
  > the command-line arguments after kern_execve() returns, this should
  > be safe, and it fixes the memory leak which can otherwise occur.
  >
  > Submitted by:   Peter Holm
  > MFC after:      3 days
  > Security:       Local denial of service
  
  Approved by:    re (scottl)
  
  Revision   Changes    Path
  1.275.2.2  +8 -0      src/sys/kern/kern_exec.c