@@ -1833,9 +1833,14 @@ pathloc = pinterpreter->p_offset; endbyte = pathloc + pathsz; + if (pathsz < 2) /* need at least one char plus NUL */ + return (result_failure); + limited_to_first_page = pathloc < PAGE_SIZE && endbyte < PAGE_SIZE; if (limited_to_first_page) { bcopy(imgp->image_header + pathloc, data, pathsz); + if (data[pathsz - 1] != '\0') /* unterminated string */ + return (result_failure); return (result_success); } @@ -1859,6 +1864,8 @@ bcopy(page + firstloc, data, pathsz); exec_unmap_page(lwb); + if (data[pathsz - 1] != '\0') /* unterminated string */ + return (result_failure); return (result_success); }