fspy_preload_unix: execl with 32+ arguments aborts on an out-of-bounds NULL terminator write

从 with_argv.rs 以及 argc 至少为 32 时到达的堆分支开始；使用 cargo test --offline -p fspy --test execl_many_args -- --nocapture 重现边界。确认 preload 路径能够处理 execl、execlp 和 execle 的 31、32 和 33 个非 NULL 条目而不会中止，然后运行回归用例。

Summary

When fspy tracks a Unix child process that calls execl, execlp, or execle with at least 32 non-NULL argv entries (including arg0), the preload interposer aborts the child process.

In with_argv, the heap branch creates a slice with exactly argc elements, then writes the required NULL terminator at out[argc]:

let ptr = libc::malloc(argc * size_of::<*const c_char>());
let out = slice::from_raw_parts_mut(ptr.cast(), argc);
// ...
out[argc].write(core::ptr::null());

The valid indices are 0..argc, so this deterministically panics. Because the panic occurs inside an extern "C" interposer, it cannot unwind and the process aborts.

Reproduction

Reproduced against 44186c8 on macOS through the real fspy preload path. A temporary fspy integration test called libc::execl("/usr/bin/true", ...) from inside track_fn! and was run with:

cargo test --offline -p fspy --test execl_many_args -- --nocapture

Observed failure:

with_argv.rs:52:5:
index out of bounds: the len is 32 but the index is 32

panic in a function that cannot unwind
thread caused non-unwinding panic. aborting.

Trigger flow

cached/auto-tracked task
  -> fspy preload is injected into a child process
  -> the tracked native process calls execl/execlp/execle
  -> with_argv rebuilds argv
  -> argc >= 32 selects heap storage
  -> out[argc] writes past the slice boundary
  -> non-unwinding panic aborts the child

This is not triggered merely because a command has 32 arguments: the tracked program must use one of the variadic execl* APIs. Calls through execv/execve, posix_spawn, and most common high-level process APIs do not use this path. That makes the scenario uncommon, but deterministic for native tools that invoke execl* with sufficiently many arguments.

Suggested coverage

Allocate space for argc + 1 entries and add real preload regression cases at the 31/32/33 boundary for execl, execlp, and execle.