d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Only realloc() environ if we're sure that we know where it came from.

Browse Source 
The recent problems with sshd were due to sshd reassigning
`environ' when setenv() thinks it owns it.  setenv() subsequently
realloc()s the new version of environ and *boom*
This commit is contained in:
Brian Somers 2000-09-20 03:05:37 +00:00
parent d9e2f78b50
commit b1daa1b9db
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=66101
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lib/libc/stdlib/malloc.c
View File

@ -20,6 +20,7 @@
#ifndef MALLOC_EXTRA_SANITY #ifndef MALLOC_EXTRA_SANITY
#undef MALLOC_EXTRA_SANITY #undef MALLOC_EXTRA_SANITY
#endif #endif
#define MALLOC_EXTRA_SANITY
/* /*
* What to use for Junk. This is the byte value we use to fill with * What to use for Junk. This is the byte value we use to fill with

9
lib/libc/stdlib/setenv.c
View File

@ -56,7 +56,7 @@ setenv(name, value, rewrite)
int rewrite; int rewrite;
{ {
extern char **environ; extern char **environ;
static int alloced; /* if allocated space before */ static char **alloced; /* if allocated space before */
register char *c; register char *c;
int l_value, offset; int l_value, offset;
@ -75,21 +75,20 @@ setenv(name, value, rewrite)
register char **p; register char **p;
for (p = environ, cnt = 0; *p; ++p, ++cnt); for (p = environ, cnt = 0; *p; ++p, ++cnt);
if (alloced) { /* just increase size */ if (alloced == environ) { /* just increase size */
p = (char **)realloc((char *)environ, p = (char **)realloc((char *)environ,
(size_t)(sizeof(char *) * (cnt + 2))); (size_t)(sizeof(char *) * (cnt + 2)));
if (!p) if (!p)
return (-1); return (-1);
environ = p; alloced = environ = p;
} }
else { /* get new space */ else { /* get new space */
/* copy old entries into it */ /* copy old entries into it */
p = malloc((size_t)(sizeof(char *) * (cnt + 2))); p = malloc((size_t)(sizeof(char *) * (cnt + 2)));
if (!p) if (!p)
return (-1); return (-1);
alloced = 1;
bcopy(environ, p, cnt * sizeof(char *)); bcopy(environ, p, cnt * sizeof(char *));
environ = p; alloced = environ = p;
} }
environ[cnt + 1] = NULL; environ[cnt + 1] = NULL;
offset = cnt; offset = cnt;