https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298747
Bug ID: 298747
Summary: clearenv() segfaults when the environment is already
empty
Product: Base System
Version: 15.1-RELEASE
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: bin
Assignee: [email protected]
Reporter: [email protected]
Simple test program to reproduce the problem:
#include <stdlib.h>
int main(void) { clearenv(); return 0; }
Compile:
cc -o test test.c
Execute normally, all is well:
# ./test && echo $?
0
Execute with an empty environment:
# env -i ./test
Segmentation fault (core dumped) env -i ./test
Was actually found executing a perl script that contained the following idiom:
%ENV = ( PATH => '/bin:/usr/bin:/usr/local/bin' );
This causes perl to call clearenv() and then populate with the PATH, which core
dumped perl. Reproduced with the much simpler C program documented above.
Looking at /usr/src/lib/libc/stdlib/getenv.c I believe this is the sequence:
__build_env() returns success without allocating when the environment is empty.
clearenv() has a guard to check the __build_env() return was success, but not
to check that the environment wasn't empty (enVars == NULL), the clearing loop
never runs as envVarsTotal - 1 is -1.
Finally, in __rebuild_environ() it dies on the line "intEnviron[environNdx] =
NULL;" because intEnviron is NULL, environNdx is 0, so it's really NULL[0] =
NULL.
A check could be put in clearenv() to look for __build_env returning an empty
environment. A check could also be put in __rebuild_environ() that intEnviron
is not NULL. I'm not sure which would be better, or if both are advised.
--
You are receiving this mail because:
You are the assignee for the bug.
