jail: prevent a null derefence on array parameter assignment

The same variable was used as a counter for an inner and out loop.
Add a new one for the inner loop.

PR:		283934
Reported by:	crest at rlwinm.de

1 files changed, 4 insertions, 3 deletions

diff --git a/usr.sbin/jail/config.c b/usr.sbin/jail/config.c
index 188f48732561..cc05c2916ca0 100644
--- a/usr.sbin/jail/config.c
+++ b/usr.sbin/jail/config.c
@@ -134,7 +134,7 @@ load_config(const char *cfname)
 	struct cfparams opp;
 	struct cfjail *j, *tj, *wj;
 	struct cfparam *p, *vp, *tp;
-	struct cfstring *s, *vs, *ns;
+	struct cfstring *s, *vs, *ns, *cs;
 	struct cfvar *v, *vv;
 	char *ep;
 	int did_self, jseq, pgen;
@@ -246,13 +246,14 @@ load_config(const char *cfname)
 				while ((vv = STAILQ_NEXT(vv, tq)))
 					vv->pos += vs->len;
 				s->len += vs->len;
+				cs = s;
 				while ((vs = TAILQ_NEXT(vs, tq))) {
 					ns = emalloc(sizeof(struct cfstring));
 					ns->s = estrdup(vs->s);
 					ns->len = vs->len;
 					STAILQ_INIT(&ns->vars);
-					TAILQ_INSERT_AFTER(&p->val, s, ns, tq);
-					s = ns;
+					TAILQ_INSERT_AFTER(&p->val, cs, ns, tq);
+					cs = ns;
 				}
 			free_var:
 				free(v->name);