From 89012cf94caa6e782b928d0eacfbf840244ffb6b Mon Sep 17 00:00:00 2001
From: Peter Stephenson
Date: Fri, 19 Dec 2014 22:15:24 +0000
Subject: 34015: disallow strange environment variable names.
These are ones with the top bit set in any character.
Don't import them, and don't export them.
---
Src/params.c | 39 +++++++++++++++++++++++----------------
1 file changed, 23 insertions(+), 16 deletions(-)
(limited to 'Src/params.c')
diff --git a/Src/params.c b/Src/params.c
index 1c51afd7a..b8e0c429b 100644
--- a/Src/params.c
+++ b/Src/params.c
@@ -641,9 +641,17 @@ split_env_string(char *env, char **name, char **value)
if (!env || !name || !value)
return 0;
- tenv = metafy(env, strlen(env), META_HEAPDUP);
- for (str = tenv; *str && *str != '='; str++)
- ;
+ tenv = strcpy(zhalloc(strlen(env) + 1), env);
+ for (str = tenv; *str && *str != '='; str++) {
+ if (STOUC(*str) >= 128) {
+ /*
+ * We'll ignore environment variables with names not
+ * from the portable character set since we don't
+ * know of a good reason to accept them.
+ */
+ return 0;
+ }
+ }
if (str != tenv && *str == '=') {
*str = '\0';
*name = tenv;
@@ -4357,18 +4365,7 @@ arrfixenv(char *s, char **t)
int
zputenv(char *str)
{
- char *ptr;
DPUTS(!str, "Attempt to put null string into environment.");
- /*
- * The environment uses NULL-terminated strings, so just
- * unmetafy and ignore the length.
- */
- for (ptr = str; *ptr && *ptr != Meta; ptr++)
- ;
- if (*ptr == Meta) {
- str = dupstring(str);
- unmetafy(str, NULL);
- }
#ifdef USE_SET_UNSET_ENV
/*
* If we are using unsetenv() to remove values from the
@@ -4377,11 +4374,21 @@ zputenv(char *str)
* Unfortunately this is a slightly different interface
* from what zputenv() assumes.
*/
+ char *ptr;
int ret;
- for (ptr = str; *ptr && *ptr != '='; ptr++)
+ for (ptr = str; *ptr && STOUC(*ptr) < 128 && *ptr != '='; ptr++)
;
- if (*ptr) {
+ if (STOUC(*ptr) >= 128) {
+ /*
+ * Environment variables not in the portable character
+ * set are non-standard and we don't really know of
+ * a use for them.
+ *
+ * We'll disable until someone complains.
+ */
+ return 1;
+ } else if (*ptr) {
*ptr = '\0';
ret = setenv(str, ptr+1, 1);
*ptr = '=';
--
cgit 1.4.1