git: aca9811160f4 - stable/15 - jail: prevent a null derefence on array parameter assignment

The branch stable/15 has been updated by jamie:

URL: https://cgit.FreeBSD.org/src/commit/?id=aca9811160f4dd9e6ed94b8b08ad2285e3390c1c

commit aca9811160f4dd9e6ed94b8b08ad2285e3390c1c
Author:     Jamie Gritton <jamie@FreeBSD.org>
AuthorDate: 2026-07-01 18:36:08 +0000
Commit:     Jamie Gritton <jamie@FreeBSD.org>
CommitDate: 2026-07-05 02:49:58 +0000

    jail: prevent a null derefence on array parameter assignment
    
    The same variable was used as a counter for an inner and out loop.
    Add a new one for the inner loop.
    
    PR:             283934
    Reported by:    crest at rlwinm.de
    
    (cherry picked from commit 6d9bc46cd7fc48ece597162d3ca413fc9d67b5f0)
---
 usr.sbin/jail/config.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/usr.sbin/jail/config.c b/usr.sbin/jail/config.c
index 188f48732561..cc05c2916ca0 100644
--- a/usr.sbin/jail/config.c
+++ b/usr.sbin/jail/config.c
@@ -134,7 +134,7 @@ load_config(const char *cfname)
 	struct cfparams opp;
 	struct cfjail *j, *tj, *wj;
 	struct cfparam *p, *vp, *tp;
-	struct cfstring *s, *vs, *ns;
+	struct cfstring *s, *vs, *ns, *cs;
 	struct cfvar *v, *vv;
 	char *ep;
 	int did_self, jseq, pgen;
@@ -246,13 +246,14 @@ load_config(const char *cfname)
 				while ((vv = STAILQ_NEXT(vv, tq)))
 					vv->pos += vs->len;
 				s->len += vs->len;
+				cs = s;
 				while ((vs = TAILQ_NEXT(vs, tq))) {
 					ns = emalloc(sizeof(struct cfstring));
 					ns->s = estrdup(vs->s);
 					ns->len = vs->len;
 					STAILQ_INIT(&ns->vars);
-					TAILQ_INSERT_AFTER(&p->val, s, ns, tq);
-					s = ns;
+					TAILQ_INSERT_AFTER(&p->val, cs, ns, tq);
+					cs = ns;
 				}
 			free_var:
 				free(v->name);