2 files changed, 31 insertions, 6 deletions
diff --git a/internal/pkg/exec.go b/internal/pkg/exec.go
index c51cd701..539bd935 100644
--- a/internal/pkg/exec.go
+++ b/internal/pkg/exec.go
@@ -84,9 +84,17 @@ func (a *execArtifact) Kind() Kind { return KindExec }
 func (a *execArtifact) Params() []byte {
 	var buf bytes.Buffer
 	for _, p := range a.paths {
-		buf.WriteString(p.P.String())
-		id := Ident(p.A)
-		buf.Write(id[:])
+		if p.P != nil {
+			buf.WriteString(p.P.String())
+		} else {
+			buf.WriteString("invalid P\x00")
+		}
+		if p.A != nil {
+			id := Ident(p.A)
+			buf.Write(id[:])
+		} else {
+			buf.WriteString("invalid A\x00")
+		}
 	}
 	buf.WriteByte(0)
 	buf.WriteString(a.dir.String())
@@ -106,9 +114,11 @@ func (a *execArtifact) Params() []byte {
 // Dependencies returns a slice of all artifacts collected from caller-supplied
 // [ExecContainerPath].
 func (a *execArtifact) Dependencies() []Artifact {
-	artifacts := make([]Artifact, len(a.paths))
-	for i, p := range a.paths {
-		artifacts[i] = p.A
+	artifacts := make([]Artifact, 0, len(a.paths))
+	for _, p := range a.paths {
+		if p.A != nil {
+			artifacts = append(artifacts, p.A)
+		}
 	}
 	return artifacts
 }
@@ -123,6 +133,9 @@ func (a *execArtifact) Cure(c *CureContext) (err error) {
 
 	paths := make([][2]*check.Absolute, len(a.paths))
 	for i, p := range a.paths {
+		if p.P == nil || p.A == nil {
+			return os.ErrInvalid
+		}
 		paths[i][1] = p.P
 	}
 
diff --git a/internal/pkg/exec_test.go b/internal/pkg/exec_test.go
index e718b260..25fe8894 100644
--- a/internal/pkg/exec_test.go
+++ b/internal/pkg/exec_test.go
@@ -96,6 +96,18 @@ func TestExec(t *testing.T) {
 						},
 					}),
 				), nil, pkg.Checksum{}, errors.Join(stub.UniqueError(0xcafe))},
+
+				{"invalid paths", pkg.NewExec(
+					t.Context(),
+					msg,
+					0,
+					check.MustAbs("/work"),
+					[]string{"HAKUREI_TEST=1"},
+					check.MustAbs("/opt/bin/testtool"),
+					[]string{"testtool"},
+
+					pkg.ExecContainerPath{},
+				), nil, pkg.Checksum{}, os.ErrInvalid},
 			})
 
 			// check init failure passthrough