--- Libc/Libc-1158.30.7/sys/posix_spawn.c
+++ Libc/Libc-1669.40.2/sys/posix_spawn.c
@@ -89,7 +89,7 @@
 		env_path = _PATH_DEFPATH;
 
 	/* If it's an absolute or relative path name, it's easy. */
-	if (index(file, '/')) {
+	if (strchr(file, '/')) {
 		bp = (char *)file;
 		cur = NULL;
 		goto retry;
@@ -144,14 +144,28 @@
 		case ENOEXEC:
 			for (cnt = 0; argv[cnt]; ++cnt)
 				;
-			memp = alloca((cnt + 2) * sizeof(char *));
+
+			/*
+			 * cnt may be 0 above; always allocate at least
+			 * 3 entries so that we can at least fit "sh", bp, and
+			 * the NULL terminator.  We can rely on cnt to take into
+			 * account the NULL terminator in all other scenarios,
+			 * as we drop argv[0].
+			 */
+			memp = alloca(MAX(3, cnt + 2) * sizeof(char *));
 			if (memp == NULL) {
 				/* errno = ENOMEM; XXX override ENOEXEC? */
 				goto done;
 			}
-			memp[0] = "sh";
-			memp[1] = bp;
-			bcopy(argv + 1, memp + 2, cnt * sizeof(char *));
+			if (cnt > 0) {
+				memp[0] = argv[0];
+				memp[1] = bp;
+				bcopy(argv + 1, memp + 2, cnt * sizeof(char *));
+			} else {
+				memp[0] = "sh";
+				memp[1] = bp;
+				memp[2] = NULL;
+			}
 			err = posix_spawn(pid, _PATH_BSHELL, file_actions, attrp, memp, envp);
 			goto done;
 		default: