check exec() arg length

fix double iunlockput

diff --git a/exec.c b/exec.c
index 2e2ced4610ff815efdf00fe51144aedc7f948e2d..c0ea51526f95fe48ce17b07e0354b25afc2b94cd 100644 (file)
--- a/exec.c
+++ b/exec.c
@@ -44,6 +44,7 @@ exec(char *path, char **argv)
       goto bad;
   }
   iunlockput(ip);
+  ip = 0;
 
   // Allocate a one-page stack at the next page boundary
   sz = PGROUNDUP(sz);
@@ -105,6 +106,9 @@ exec(char *path, char **argv)
   uint ffffffff = 0xffffffff;
   copyout(pgdir, sp, &ffffffff, 4);
 
+  if(sp < sz - PGSIZE)
+    goto bad;
+
   // Save program name for debugging.
   for(last=s=path; *s; s++)
     if(*s == '/')
@@ -125,8 +129,9 @@ exec(char *path, char **argv)
   return 0;
 
  bad:
-  cprintf("kernel: exec failed\n");
-  if(pgdir) freevm(pgdir);
-  iunlockput(ip);
+  if(pgdir)
+    freevm(pgdir);
+  if(ip)
+    iunlockput(ip);
   return -1;
 }