Skip to content

fix(fspy): allocate a slot for the NULL terminator in execl with 32+ arguments - #865

Merged
wan9chi merged 2 commits into
voidzero-dev:mainfrom
tlq5l:fix/fspy-execl-argv-terminator
Oct 26, 2026
Merged

fix(fspy): allocate a slot for the NULL terminator in execl with 32+ arguments#865
wan9chi merged 2 commits into
voidzero-dev:mainfrom
tlq5l:fix/fspy-execl-argv-terminator

Conversation

@tlq5l

@tlq5l tlq5l commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Fixes #699

Motivation

with_argv builds the argv array for execl, execlp and execle. With 32 or more arguments it takes the heap branch, which allocated exactly argc slots and then wrote the closing NULL at out[argc]. That index panicked inside an extern "C" interposer, which aborted the traced process.

Change

  • Allocate argc + 1 slots in the heap branch, so the NULL terminator has room.
  • New test crates/fspy/tests/execl_many_args.rs calls execl with 40 arguments under fspy and checks the child exits normally. It aborts without the fix.
  • Changelog entry under Unreleased.

Ran live: a C program that calls execl("/bin/echo", "echo", "a1", ..., "a40", NULL), run as a cached task with vt run many. On a clean build of main it printed index out of bounds: the len is 41 but the index is 41 and fatal runtime error: failed to initiate panic; on a clean build of this branch it printed a1 a2 ... a40.

@tlq5l
tlq5l force-pushed the fix/fspy-execl-argv-terminator branch from 6e4f8df to 81b6f34 Compare October 19, 2026 22:27
@tlq5l DeepSeek V4.1 Flash @claude
fix(fspy): allocate a slot for the NULL terminator in execl with 32+ …
d6a4a1a 
…arguments

Fixes voidzero-dev#699

The heap branch of `with_argv` allocated exactly `argc` slots, then wrote
the closing NULL at `out[argc]`. That panicked inside an `extern "C"`
interposer, which aborted the traced process. Allocate `argc + 1` slots.

Co-authored-by: DeepSeek V4.1 Flash <noreply@deepseek.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@tlq5l
tlq5l force-pushed the fix/fspy-execl-argv-terminator branch from 81b6f34 to d6a4a1a Compare October 21, 2026 17:46
@wan9chi wan9chi added the ci: full Run the slow CI jobs (macOS x64, musl) on this pull request label Oct 26, 2026
@wan9chi
wan9chi merged commit 194ee9c into voidzero-dev:main Oct 26, 2026
20 checks passed
@wan9chi

wan9chi commented Oct 26, 2026

Copy link
Copy Markdown
Member

Thank you!

@wan9chi wan9chi mentioned this pull request Oct 26, 2026
Merged
wan9chi added a commit that referenced this pull request Oct 26, 2026
@wan9chi @claude
refactor(fspy): collect execl arguments in the call's bump allocator (#…
6d1a6b2 
…891)

## Motivation

`execl`, `execlp` and `execle` pass their arguments as a variadic list,
so the interposer has to build an argv array before it can handle the
exec. It used a 32-slot stack array, fell back to libc `malloc` for
longer lists, and failed with `E2BIG` past a hardcoded 4096 arguments.
That split is where #865's out-of-bounds write lived, and the `malloc`
fallback isn't async-signal-safe: exec may run in the child of `fork()`,
where malloc's lock may be held by a thread that no longer exists.

## Change

- A small `collect_argv` pushes `arg` and the variadic arguments, up to
and including the NULL, into an `allocator_api2::vec::Vec` in the call's
`pooled_bump()`, and leaves the `VaList` where `execle` reads `envp`.
- Each of the three interposers creates one bump and passes it to both
`collect_argv` and `handle_exec`, as `execveat` already does.
- `with_argv.rs` is removed along with the stack/heap split and the
4096-argument limit; the real `execve` reports `E2BIG` instead.

The rest of the exec path still allocates through libc `malloc`
(`RawExec::to_exec`/`from_exec`, `fexecve`); the PR stacked on this one
removes that.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@cursor cursor Bot mentioned this pull request Oct 26, 2026
Merged
@fengmk2 fengmk2 mentioned this pull request Nov 3, 2026
Merged
fengmk2 added a commit to voidzero-dev/vite-plus that referenced this pull request Nov 4, 2026
@voidzero-guard @fengmk2 @claude
release: v1.5.0 (#3336)
671b5e4 
Vite+ 1.5 adds an official Homebrew tap, runs TypeScript through Node.js
with `node --import vite-plus/register`, and lets `vp migrate` move
`oxnode` and transpile-only `ts-node` scripts to `vpx`.

### Features

- Install `vp` from the official Homebrew tap on macOS and glibc Linux
([docs](https://viteplus.dev/guide/homebrew))
([#2740](#2740)), by
@fengmk2:
  ```bash
brew tap voidzero-dev/vite-plus
https://github.com/voidzero-dev/vite-plus
  brew install voidzero-dev/vite-plus/vp
  ```
- `node --import vite-plus/register` runs TypeScript with the same
loader as `vpx`, so tools that start Node.js themselves, such as the
Node.js test runner, AVA, or a `NODE_OPTIONS` setting, can run
TypeScript files
([docs](https://viteplus.dev/guide/vpx#using-node-js-directly))
([#3208](#3208)), by
@fengmk2.
- `vp migrate` moves `oxnode` commands and transpile-only `ts-node`
commands to `vpx`, and moves their Node.js preloads and literal
`NODE_OPTIONS` values to `vite-plus/register`. `ts-node` commands that
type-check stay unchanged with a warning, and the `ts-node` dependency
is removed only when nothing still uses it. A project already on Vite+
gets this migration with `vp migrate --full`
([docs](https://viteplus.dev/guide/migrate-rules#oxnode-to-vpx))
([#3209](#3209),
[#3210](#3210)), by
@fengmk2.
- `vp migrate` warns when it finds Rollup, Rolldown, or Jest
dependencies with matching configuration, and explains how to move them
to Vite, tsdown, or Vitest. The warnings show during the first
migration, or with `vp migrate --full` in a project already on Vite+
([#3275](#3275)), by
@KTrain5169 and @fengmk2.
- `vite-plus` exports `resolveConfigFromFile(configFile, options?)`,
which resolves a config relative to the config file's directory instead
of `process.cwd()`, so editor plugins with several workspace folders
load the files of the right project
([#3249](#3249)), by
@leaysgur and @fengmk2.
- Security: the CLI ships `minimatch@11.0.4`, which fixes a denial of
service through glob pattern amplification
([GHSA-g3hv-75wg-m249](GHSA-g3hv-75wg-m249),
medium), and `zstd@0.13.4`, which fixes
[RUSTSEC-2026-0391](https://rustsec.org/advisories/RUSTSEC-2026-0391),
[RUSTSEC-2026-0398](https://rustsec.org/advisories/RUSTSEC-2026-0398),
and
[RUSTSEC-2026-0403](https://rustsec.org/advisories/RUSTSEC-2026-0403)
([#3328](#3328),
[#3331](#3331)), by
@renovate[bot] and @wan9chi.
- Upgrade the bundled tools
([#3205](#3205),
[#3236](#3236),
[#3261](#3261),
[#3206](#3206),
[#3330](#3330),
[#3338](#3338)), by
@voidzero-guard[bot] and @fengmk2:
- `rolldown@1.2.15` to `rolldown@1.2.16`, with
`experimentalInlineCommonChunks` in dev mode and no crash when the
working directory was deleted.
- `tsdown@0.23.1` to `tsdown@0.23.4`: `vp pack --env-file` can be
repeated to load several env files, the config has a JSON schema, and
`?inline` CSS imported from dependencies is inlined.
- `vitest@5.0.5` to `vitest@5.1.0`, with `--last-failed` and
`--since-last-run`, fake timers for `node:timers`, and interactive
review of failed snapshots. Browser mode now uses port 23315 by default.
- `oxlint@1.89.0` to `oxlint@1.91.0` and `oxlint-tsgolint@7.0.2004` to
`oxlint-tsgolint@7.0.2005`, with the new type-aware rule
`typescript/no-unsafe-enum-assignment`, wider checks in rules such as
`array-callback-return`, `no-useless-concat`, and `no-control-regex`,
and two rules moved into the `suspicious` category.
- `oxfmt@0.74.0` to `oxfmt@0.76.0`, with a new HTML formatter and
JavaScript and TypeScript fixes for parentheses, array layout, and line
width with wide characters.
- The new oxlint and oxfmt versions can flag code that passed before. If
your CI runs `vp check`, run `vp fmt` after upgrading.
- `vpx` and `vite-plus/register` run on `oxc-node@1.0.1`, which resolves
a `.jsx` specifier to its `.tsx` or `.ts` source.

### Fixes & Enhancements

- `vp create` into a target path that is a symbolic link removes only
the link after confirmation, instead of deleting the contents of the
linked directory, and the overwrite prompt names symbolic links and
files ([#2418](#2418)), by
@leslieeilsel and @fengmk2.
- `vp implode` removes only directories and shims that it can verify as
Vite+ installations, and refuses the home directory, its parents, and
filesystem roots even with `--yes`, so a `VP_HOME` that points at
another directory cannot delete unrelated files
([#3228](#3228)), by
@jong-kyung.
- `vp run` starts faster in workspaces whose tasks share cache `input`
and `output` patterns, because each pattern is parsed once. In a
138-package workspace this saves about 2 seconds of CPU on every run
([vite-task#887](voidzero-dev/vite-task#887),
[vite-task#890](voidzero-dev/vite-task#890)), by
@jasonkuhrt and @wan9chi.
- `vp run` and package-manager commands in npm projects start about 110
ms sooner, because `vp` reads the npm version from npm's `package.json`
instead of running `npm --version`
([#3259](#3259)), by
@magurotuna.
- `vp migrate` checks Vitest prerequisites faster in workspaces, because
it parses each lockfile once
([#3212](#3212)), by
@jong-kyung.
- The installer and `vp upgrade` install the global CLI's dependencies
with the Node.js version that the release pins (24.22.2 for this
release), instead of the latest LTS
([docs](https://viteplus.dev/guide/ci#node-js-during-installation))
([#3269](#3269)), by
@fengmk2.
- The Node.js `latest` alias in `vp env use`, `vp env default`, `vp env
pin`, `vp env install`, and `.nvmrc` resolves to the newest stable
release instead of a `27.0.0-alpha` build, and `vp env list-remote`
marks that stable release as latest
([#3335](#3335)), by
@voidzero-bot[bot] and @fengmk2.
- `VP_NODE_VERSION=22` and other partial versions work for project
commands such as `vp build`, `vp run`, and `vp list`, instead of failing
with a 404 download error
([#3341](#3341)), by
@jong-kyung.
- Two `vp install -g` commands that run at the same time no longer
delete each other's active package, and a command that starts while a
package manager is being installed no longer runs its shim before the
shim is executable
([#3185](#3185),
[#3248](#3248)), by
@jong-kyung.
- `vp config` waits and retries when another linked git worktree holds
the shared git config lock, so a `prepare` script no longer fails when
two worktrees install at the same time
([#3199](#3199)), by
@naokihaba.
- `vp env doctor` reports Node.js resolution failures, unreadable
config, a failing system `node`, and missing shims as errors and exits
with code 1. When it finds only warnings, the summary says `Some
warnings found` instead of `All checks passed`
([#3215](#3215),
[#3222](#3222)), by
@liangmiQwQ.
- Nushell completions for `vp` and `vpr` use the named completer input,
so Nushell 0.116 shows no deprecation warning, and they fall back to
file completion when fish is not installed. Run `vp env setup --refresh`
to regenerate `env.nu`
([#3267](#3267),
[#3276](#3276)), by
@naokihaba.
- `vp migrate` removes the `tsx` dependency even when a comment still
contains a `tsx` command or code fence, and keeps it for JSDoc type
imports that need it
([#3299](#3299)), by
@voidzero-bot[bot] and @fengmk2.
- The `prefer-vite-plus-imports` lint rule and its autofix leave the
`vite` and `vitest` imports that `vp migrate` keeps, such as `vitest`
imports in a package that lists `vitest` in `peerDependencies`, so `vp
lint --fix` no longer breaks the package for its plain Vitest users
([#3192](#3192)), by
@Dunqing.
- Generated Zed settings no longer force `typeAware` and
`unusedDisableDirectives`, so editor diagnostics follow the
`lint.options` in `vite.config.ts`. Existing editor settings stay
unchanged
([#2357](#2357)), by
@pweyck.
- `vp dlx` with npm runs the right executable for scoped packages such
as `@angular/cli`
([#3229](#3229)), by
@jong-kyung.
- `vp outdated -r` in npm projects checks the workspaces instead of
transitive dependencies, and requires npm 7.14.0 or later
([#3240](#3240)), by
@jong-kyung.
- Dependency filters such as `--prod` and `--dev` work with npm 6, and
filters that npm 6 cannot apply are rejected instead of passed through
([#3251](#3251)), by
@jong-kyung.
- Package-manager commands that the selected version does not have, such
as `vp pm stage` before npm 11.15.0, are skipped with a warning.
Unsupported `pnpm dlx` and `pnpm pack` options, and project-only flags
on managed global commands such as `vp install -g`, are rejected instead
of silently ignored
([#3286](#3286),
[#3285](#3285)), by
@jong-kyung.
- `vp toolchain -g` is short for `vp toolchain --global`
([#3189](#3189)), by
@jong-kyung.
- On Linux and macOS, programs in tasks with automatic file-access
tracking no longer abort when they call `exec` with an empty path or
`execl` with 32 or more arguments
([vite-task#896](voidzero-dev/vite-task#896),
[vite-task#865](voidzero-dev/vite-task#865)), by
@wan9chi and @tlq5l.

### Refactor

- Remove the test-only package download wrapper
([#3224](#3224)), by
@jong-kyung.

### Docs

- Explain that `vp check` stops at formatting failures, and that `vp
check` flags go before file paths
([#3262](#3262)), by
@SaKaNa-Y.
- Show how to align an existing `vite` dependency with its override
during a manual npm installation, to avoid `EOVERRIDE`
([#3157](#3157)), by
@SaKaNa-Y.
- Explain how environment variable prefixes such as `FOO=bar command`
work in task commands on every platform
([#3161](#3161)), by
@tartelettie.
- Restore the `/vp-setup` redirect and the redirects for moved guide
pages ([#3271](#3271)), by
@fengmk2.
- Align the labels of "See [...]" section links with their target titles
([#3231](#3231)), by
@yamaurakazuto.

### Chore

- Bump vite-task to `40cb9ca`; its user-facing changes are listed above
([#3246](#3246),
[#3280](#3280)), by
@wan9chi.
- Keep CI working on the Node.js 26 LTS and Ubuntu 24.04, cap job
runtimes, reduce Node.js downloads, avoid upgrade build and snapshot
download timeouts, pin Nushell, and restore Namespace Linux runners
([#3198](#3198),
[#3258](#3258),
[#3266](#3266),
[#3268](#3268),
[#3303](#3303),
[#3309](#3309),
[#3320](#3320),
[#3332](#3332)), by
@fengmk2 and @wan9chi.
- Add automated issue triage
([#3253](#3253),
[#3260](#3260)), by
@Boshen and @fengmk2.
- Run the upstream dependency upgrade with Kimi K3.1 Pro and report its
timeouts ([#3314](#3314),
[#3304](#3304)), by
@Brooooooklyn and @wan9chi.
- Stabilize and trim tests: rerun ESLint and Prettier migration fixtures
with `--full`, stabilize pnpm setup and Bun snapshots, update the tiptap
ecosystem pin, use a recorded package in the install shortcut case, and
remove duplicate `devEngines` parse tests
([#3193](#3193),
[#3196](#3196),
[#3242](#3242),
[#3305](#3305),
[#3301](#3301)), by
@liangmiQwQ, @fengmk2, @wan9chi, and @Brooooooklyn.
- Update Rust crates, synchronize workspace dependency requirements, and
stop installing `dprint` and `taplo` in `just init`
([#3234](#3234),
[#3310](#3310),
[#3250](#3250)), by
@renovate[bot], @leaysgur, and @fengmk2.
- Refine contributor guidance: the release-manager skill, isolated CLI
bootstrap checks in `AGENTS.md`, and the Rolldown exports in the CLI
bundling notes
([#3207](#3207),
[#3238](#3238),
[#3316](#3316)), by
@fengmk2 and @liangmiQwQ.

### Bundled Versions

| Tool | Version | Source | Changelog |
| --------------- | ---------- |
----------------------------------------------------------------------------------------------------
|
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
| vite | `8.3.5` |
[`981f07f`](vitejs/vite@981f07f)
| unchanged |
| rolldown | `1.2.16` |
[`de6facf`](rolldown/rolldown@de6facf)
| [1.2.16](https://github.com/rolldown/rolldown/releases/tag/v1.2.16) |
| oxc-node | `1.0.1` |
[`7ff14c3`](oxc-project/oxc-node@7ff14c3)
| [1.0.1](https://github.com/oxc-project/oxc-node/releases/tag/v1.0.1) |
| tsdown | `0.23.4` | [npm](https://npmx.dev/package/tsdown/v/0.23.4) |
[0.23.2](https://github.com/rolldown/tsdown/releases/tag/v0.23.2),
[0.23.3](https://github.com/rolldown/tsdown/releases/tag/v0.23.3),
[0.23.4](https://github.com/rolldown/tsdown/releases/tag/v0.23.4) |
| vitest | `5.1.0` | [npm](https://npmx.dev/package/vitest/v/5.1.0) |
[5.1.0](https://github.com/vitest-dev/vitest/releases/tag/v5.1.0) |
| oxlint | `1.91.0` | [npm](https://npmx.dev/package/oxlint/v/1.91.0) |
[1.90.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.90.0),
[1.91.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.91.0)
|
| oxlint-tsgolint | `7.0.2005` |
[npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2005) |
[7.0.2005](https://github.com/oxc-project/tsgolint/releases/tag/v7.0.2005)
|
| oxfmt | `0.76.0` | [npm](https://npmx.dev/package/oxfmt/v/0.76.0) |
[0.75.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.75.0),
[0.76.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.76.0)
|

### Upgrade

```bash
vp upgrade
```

### New Contributors

@yamaurakazuto, @tartelettie, @pweyck, @jasonkuhrt

**Full Changelog**:
v1.4.0...v1.5.0

---

Merging this PR will trigger the release workflow.

---------

Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com>
Co-authored-by: MK (fengmk2) <fengmk2@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@BrewTestBot BrewTestBot mentioned this pull request Nov 4, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ci: full Run the slow CI jobs (macOS x64, musl) on this pull request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

fspy_preload_unix: execl with 32+ arguments aborts on an out-of-bounds NULL terminator write

2 participants

@tlq5l @wan9chi