From 2de80aea8057d2b314eab5ba1d0c782ea1bb1b3a Mon Sep 17 00:00:00 2001
From: "Andrey A. Chernov" <ache@FreeBSD.org>
Date: Tue, 2 Oct 2012 17:44:08 +0000
Subject: [PATCH] Using putenv() and later direct pointer contents modification
 it is possibe to craft environment variables with similar names like that:
 a=1 a=2 ... unsetenv("a") should remove them all to make later getenv("a")
 impossible. Fix it to do so (this is GNU autoconf test #3 failure too).

PR:             172273
MFC after:      1 week
---
 lib/libc/stdlib/getenv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/libc/stdlib/getenv.c b/lib/libc/stdlib/getenv.c
index b7826d72a5d4..37602a915f40 100644
--- a/lib/libc/stdlib/getenv.c
+++ b/lib/libc/stdlib/getenv.c
@@ -675,11 +675,13 @@ unsetenv(const char *name)
 
 	/* Deactivate specified variable. */
 	envNdx = envVarsTotal - 1;
-	if (__findenv(name, nameLen, &envNdx, true) != NULL) {
+	/* Remove all occurrences. */
+	while (__findenv(name, nameLen, &envNdx, true) != NULL) {
 		envVars[envNdx].active = false;
 		if (envVars[envNdx].putenv)
 			__remove_putenv(envNdx);
 		__rebuild_environ(envActive - 1);
+		envNdx = envVarsTotal - 1;
 	}
 
 	return (0);