From 0925c9846b66dc807b1dfd97bcbc690e0b890069 Mon Sep 17 00:00:00 2001
From: nicm <nicm@openbsd.org>
Date: Sun, 12 Jul 2026 20:35:52 +0000
Subject: [PATCH] Use _exit in child after fork, from Yayo Razo in GitHub issue
 5376.

---
 cmd.c | 11 ++++++++---
 job.c | 18 +++++++++---------
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/cmd.c b/cmd.c
index b9b8f1a4a..d2e98d466 100644
--- a/cmd.c
+++ b/cmd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cmd.c,v 1.185 2026/06/26 14:40:30 nicm Exp $ */
+/* $OpenBSD: cmd.c,v 1.186 2026/07/12 20:35:52 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -846,7 +846,7 @@ cmd_template_replace(const char *template, const char *s, int idx)
 	char		 ch, *buf;
 	const char	*ptr, *cp, quote[] = "\"\\$;~";
 	int		 replaced, quoted;
-	size_t		 len;
+	size_t		 len, slen;
 
 	if (strchr(template, '%') == NULL)
 		return (xstrdup(template));
@@ -871,7 +871,10 @@ cmd_template_replace(const char *template, const char *s, int idx)
 			if (quoted)
 				ptr++;
 
-			buf = xrealloc(buf, len + (strlen(s) * 3) + 1);
+			slen = strlen(s);
+			if (slen > SIZE_MAX / 3 || len > SIZE_MAX - (slen * 3) - 1)
+				fatalx("argument too long");
+			buf = xrealloc(buf, len + (slen * 3) + 1);
 			for (cp = s; *cp != '\0'; cp++) {
 				if (quoted && strchr(quote, *cp) != NULL)
 					buf[len++] = '\\';
@@ -880,6 +883,8 @@ cmd_template_replace(const char *template, const char *s, int idx)
 			buf[len] = '\0';
 			continue;
 		}
+		if (len > SIZE_MAX - 2)
+			fatalx("argument too long");
 		buf = xrealloc(buf, len + 2);
 		buf[len++] = ch;
 		buf[len] = '\0';
diff --git a/job.c b/job.c
index 8400ea584..82e87b825 100644
--- a/job.c
+++ b/job.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: job.c,v 1.74 2025/09/08 11:21:56 nicm Exp $ */
+/* $OpenBSD: job.c,v 1.75 2026/07/12 20:35:52 nicm Exp $ */
 
 /*
  * Copyright (c) 2009 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -149,7 +149,7 @@ job_run(const char *cmd, int argc, char **argv, struct environ *e,
 			else if (chdir("/") == 0)
 				environ_set(env, "PWD", 0, "/");
 			else
-				fatal("chdir failed");
+				_exit(1);
 		}
 
 		environ_push(env);
@@ -157,21 +157,21 @@ job_run(const char *cmd, int argc, char **argv, struct environ *e,
 
 		if (~flags & JOB_PTY) {
 			if (dup2(out[1], STDIN_FILENO) == -1)
-				fatal("dup2 failed");
+				_exit(1);
 			do_close = do_close && out[1] != STDIN_FILENO;
 			if (dup2(out[1], STDOUT_FILENO) == -1)
-				fatal("dup2 failed");
+				_exit(1);
 			do_close = do_close && out[1] != STDOUT_FILENO;
 			if (flags & JOB_SHOWSTDERR) {
 				if (dup2(out[1], STDERR_FILENO) == -1)
-					fatal("dup2 failed");
+					_exit(1);
 				do_close = do_close && out[1] != STDERR_FILENO;
 			} else {
 				nullfd = open(_PATH_DEVNULL, O_RDWR);
 				if (nullfd == -1)
-					fatal("open failed");
+					_exit(1);
 				if (dup2(nullfd, STDERR_FILENO) == -1)
-					fatal("dup2 failed");
+					_exit(1);
 				if (nullfd != STDERR_FILENO)
 					close(nullfd);
 			}
@@ -185,11 +185,11 @@ job_run(const char *cmd, int argc, char **argv, struct environ *e,
 			if (flags & JOB_DEFAULTSHELL)
 				setenv("SHELL", shell, 1);
 			execl(shell, argv0, "-c", cmd, (char *)NULL);
-			fatal("execl failed");
+			_exit(1);
 		} else {
 			argvp = cmd_copy_argv(argc, argv);
 			execvp(argvp[0], argvp);
-			fatal("execvp failed");
+			_exit(1);
 		}
 	}