Repository navigation
fix(fspy): allocate a slot for the NULL terminator in execl with 32+ arguments - #865
Merged
Merged
Conversation
tlq5l
force-pushed
the
fix/fspy-execl-argv-terminator
branch
from
October 19, 2026 22:27
6e4f8df to
81b6f34
Compare
…arguments Fixes voidzero-dev#699 The heap branch of `with_argv` allocated exactly `argc` slots, then wrote the closing NULL at `out[argc]`. That panicked inside an `extern "C"` interposer, which aborted the traced process. Allocate `argc + 1` slots. Co-authored-by: DeepSeek V4.1 Flash <noreply@deepseek.com> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
tlq5l
force-pushed
the
fix/fspy-execl-argv-terminator
branch
from
October 21, 2026 17:46
81b6f34 to
d6a4a1a
Compare
wan9chi
added
the
ci: full
Member
|
Thank you! |
wan9chi
added a commit
that referenced
this pull request
Oct 26, 2026
…891) ## Motivation `execl`, `execlp` and `execle` pass their arguments as a variadic list, so the interposer has to build an argv array before it can handle the exec. It used a 32-slot stack array, fell back to libc `malloc` for longer lists, and failed with `E2BIG` past a hardcoded 4096 arguments. That split is where #865's out-of-bounds write lived, and the `malloc` fallback isn't async-signal-safe: exec may run in the child of `fork()`, where malloc's lock may be held by a thread that no longer exists. ## Change - A small `collect_argv` pushes `arg` and the variadic arguments, up to and including the NULL, into an `allocator_api2::vec::Vec` in the call's `pooled_bump()`, and leaves the `VaList` where `execle` reads `envp`. - Each of the three interposers creates one bump and passes it to both `collect_argv` and `handle_exec`, as `execveat` already does. - `with_argv.rs` is removed along with the stack/heap split and the 4096-argument limit; the real `execve` reports `E2BIG` instead. The rest of the exec path still allocates through libc `malloc` (`RawExec::to_exec`/`from_exec`, `fexecve`); the PR stacked on this one removes that. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #699
Motivation
with_argvbuilds the argv array forexecl,execlpandexecle. With 32 or more arguments it takes the heap branch, which allocated exactlyargcslots and then wrote the closing NULL atout[argc]. That index panicked inside anextern "C"interposer, which aborted the traced process.Change
argc + 1slots in the heap branch, so the NULL terminator has room.crates/fspy/tests/execl_many_args.rscallsexeclwith 40 arguments under fspy and checks the child exits normally. It aborts without the fix.Ran live: a C program that calls
execl("/bin/echo", "echo", "a1", ..., "a40", NULL), run as a cached task withvt run many. On a clean build ofmainit printedindex out of bounds: the len is 41 but the index is 41andfatal runtime error: failed to initiate panic; on a clean build of this branch it printeda1 a2 ... a40.