V7 exec vs. long arglists

[Henry Spencer]

There is a bug in the V7 exec logic.  It allocates SSIZE+nc bytes of
stack space, where SSIZE is set in param.h (typically 20 clicks) and
nc is the number of bytes in the argument/environment strings.  The
gotcha is, if SSIZE is not big enough to hold the *pointers* to those
strings, chaos ensues.  The initial part of the arglist is "written"
into an unallocated area of the user process, so those writes just
disappear into thin air.  The stack pointer points in there, however,
so just before the start of the new program the stack-growth code does
allocate memory for that stuff.  However, it's all zeroes, so the
program sees an argc of 0.  If you want to see this happen, make a
directory with a *lot* of files with very short names -- try about
700 files with four-character names -- and do "echo *" in it.

The fix is very simple.  In sys1.c/exece(), change:

 	if (getxfile(ip, nc) || u.u_error)
to:
 	if (getxfile(ip, nc + na*NBPW + 4*NBPW) || u.u_error)

The na*NBPW part is the arg/env pointers, and the 4*NBPW part is to
allow for argc, the two NULLs that terminate the pointer lists, and
the zero word at the top of core.  Possibly some of those NBPW's ought
to be sizeof's for maximum cleanliness and portability.

System III already has an approximation to this fix;  don't know about
System V or x.yBSD.
-- 
				Henry Spencer
				U of Toronto
				{allegra,ihnp4,linus,decvax}!utzoo!henry