Index: sys/kern/imgact_elf.c =================================================================== --- sys/kern/imgact_elf.c +++ sys/kern/imgact_elf.c @@ -839,17 +839,12 @@ break; case PT_INTERP: /* Path to interpreter */ - if (phdr[i].p_filesz > MAXPATHLEN) { - uprintf("Invalid PT_INTERP\n"); - error = ENOEXEC; - goto ret; - } if (interp != NULL) { uprintf("Multiple PT_INTERP headers\n"); error = ENOEXEC; goto ret; } - interp_name_len = phdr[i].p_filesz; + interp_name_len = min(phdr[i].p_filesz, MAXPATHLEN); if (phdr[i].p_offset > PAGE_SIZE || interp_name_len > PAGE_SIZE - phdr[i].p_offset) { VOP_UNLOCK(imgp->vp, 0); @@ -870,6 +865,12 @@ } else { interp = __DECONST(char *, imgp->image_header) + phdr[i].p_offset; + } + if (strlen(interp) >= MAXPATHLEN) { + uprintf("Invalid PT_INTERP (too long)\n"); + error = ENOEXEC; + VOP_UNLOCK(imgp->vp, 0); + goto ret; } break; case PT_GNU_STACK: