From ff71d78866fbff3eb37f13bc1a32d895c969809d Mon Sep 17 00:00:00 2001
From: florian <florian@openbsd.org>
Date: Mon, 1 Jan 2018 08:55:43 +0000
Subject: [PATCH] We are either allocating 2 or three array members. Unroll
 while loop to be able to call free(9) with sizes.

off-by-one pointed out by guenther
OK visa
---
 sys/kern/exec_script.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/sys/kern/exec_script.c b/sys/kern/exec_script.c
index 0b9ae86e224..b6fd5be23d5 100644
--- a/sys/kern/exec_script.c
+++ b/sys/kern/exec_script.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: exec_script.c,v 1.40 2017/02/11 19:51:06 guenther Exp $	*/
+/*	$OpenBSD: exec_script.c,v 1.41 2018/01/01 08:55:43 florian Exp $	*/
 /*	$NetBSD: exec_script.c,v 1.13 1996/02/04 02:15:06 christos Exp $	*/
 
 /*
@@ -264,11 +264,13 @@ fail:
 	pool_put(&namei_pool, epp->ep_ndp->ni_cnd.cn_pnbuf);
 
 	/* free the fake arg list, because we're not returning it */
-	if ((tmpsap = shellargp) != NULL) {
-		while (*tmpsap != NULL) {
-			free(*tmpsap, M_EXEC, 0);
-			tmpsap++;
-		}
+	if (shellargp != NULL) {
+		free(shellargp[0], M_EXEC, shellnamelen + 1);
+		if (shellargp[2] != NULL) {
+			free(shellargp[1], M_EXEC, shellarglen + 1);
+			free(shellargp[2], M_EXEC, MAXPATHLEN);
+		} else
+			free(shellargp[1], M_EXEC, MAXPATHLEN);
 		free(shellargp, M_EXEC, 4 * sizeof(char *));
 	}
 
-- 
2.20.1