The following jail.conf minimal reproducer snippet is enough to segfault jail(8) during parsing (e.g. when invoked as `jail -e $'\n'`): $x = "foo"; $x += "bar"; $y += "$x"; Instead of crashing jail(8) should either expand the multi-valued $x variable (with values joined by newlines) or at least refuse to expand multi-valued variables with a error message containing the configuration file path, line number, and a short description of the configuration error.
The parser does not crash if the expansion contains any string literals e.g. these report **non**-fatal warnings and expand $x to empty string: $y += ",$x"; $z += "$x,"; while this crashes during variable expansion: $y += "$x";
Created attachment 272136 [details] Fix a variable misuse in load_config The variable "s" in load_config is used to loop through the string values of a target parameter (looking for substitutions in each one). I also used it to loop through the string values of the source parameter when I'm copying a multi-valued source to the target. But that's within the outer loop that uses s and stomps on its value. Add another variable "cs" for the second use.
The reason ",$x" and "$x," work and "$x" doesn't is that inline substitution of an array value is illegal, but variable assignment from an array value is fine. As it turns out, even though "$x" looks like inline substitution, it is in fact a simple assignment: '$y = "$x"' is exactly the same as '$y - $x'. The reason for this is the quote marks are just used to make the parser accept what would normally be multiple tokens as a single token (that later can get variable substitution). The quote marks are long gone by the time substitution happens. So what makes a substitution inline or not? It's inline if there's anything in the target variable's value besides the the source variable. The value "$x" has nothing before besides $x itself so it's no an inline substitution but an assignment, and thus can take an array value. Apparently, people don't try to assign parameters (or variables) to multi-valued variables, because that's the code that crashes. I re-used a variable in that bit of code, which is what the patch fixes. My fault for using variable names like "s".
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=6d9bc46cd7fc48ece597162d3ca413fc9d67b5f0 commit 6d9bc46cd7fc48ece597162d3ca413fc9d67b5f0 Author: Jamie Gritton <jamie@FreeBSD.org> AuthorDate: 2026-07-01 18:36:08 +0000 Commit: Jamie Gritton <jamie@FreeBSD.org> CommitDate: 2026-07-01 18:36:08 +0000 jail: prevent a null derefence on array parameter assignment The same variable was used as a counter for an inner and out loop. Add a new one for the inner loop. PR: 283934 Reported by: crest at rlwinm.de usr.sbin/jail/config.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=cb0b277f71b642b6239539a537b94efdae1bfc6d commit cb0b277f71b642b6239539a537b94efdae1bfc6d Author: Jamie Gritton <jamie@FreeBSD.org> AuthorDate: 2026-07-01 18:36:08 +0000 Commit: Jamie Gritton <jamie@FreeBSD.org> CommitDate: 2026-07-05 02:49:53 +0000 jail: prevent a null derefence on array parameter assignment The same variable was used as a counter for an inner and out loop. Add a new one for the inner loop. PR: 283934 Reported by: crest at rlwinm.de (cherry picked from commit 6d9bc46cd7fc48ece597162d3ca413fc9d67b5f0) usr.sbin/jail/config.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=aca9811160f4dd9e6ed94b8b08ad2285e3390c1c commit aca9811160f4dd9e6ed94b8b08ad2285e3390c1c Author: Jamie Gritton <jamie@FreeBSD.org> AuthorDate: 2026-07-01 18:36:08 +0000 Commit: Jamie Gritton <jamie@FreeBSD.org> CommitDate: 2026-07-05 02:49:58 +0000 jail: prevent a null derefence on array parameter assignment The same variable was used as a counter for an inner and out loop. Add a new one for the inner loop. PR: 283934 Reported by: crest at rlwinm.de (cherry picked from commit 6d9bc46cd7fc48ece597162d3ca413fc9d67b5f0) usr.sbin/jail/config.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)