Don't allow LD_* env. variables to be tricked

Submitted by: Sam Hartman <hartmans@mit.edu>

libexec/telnetd/sys_term.c

@@ -1555,6 +1555,8 @@ start_login(host, autologin, name)
 		fatal(net, "makeutx failed");
 #endif
 
+	scrub_env();
+
 	/*
 	 * -h : pass on name of host.
 	 *		WARNING:  -h is accepted by login if and only if
@@ -1767,6 +1769,26 @@ addarg(argv, val)
 }
 #endif	/* NEWINIT */
 
+/*
+ * scrub_env()
+ *
+ * Remove a few things from the environment that
+ * don't need to be there.
+ */
+scrub_env()
+{
+	register char **cpp, **cpp2;
+
+	for (cpp2 = cpp = environ; *cpp; cpp++) {
+		if (!strncmp(*cpp, "LD_", 3) &&
+		    !strncmp(*cpp, "_RLD_", 5) &&
+		    !strncmp(*cpp, "LIBPATH=", 8) &&
+		    !strncmp(*cpp, "IFS=", 4))
+			*cpp2++ = *cpp;
+	}
+	*cpp2 = 0;
+}
+
 /*
  * cleanup()
  *