Re: PATCH: environ overflow in zexecve()

[Alexandre Duret-Lutz <duret_g@xxxxxxxxxxxxx>]

| @@ -345,6 +345,8 @@
|      for (eep = argv; *eep; eep++)
|         if (*eep != pth)
|             unmetafy(*eep, NULL);
| +
| +    /* Search $_ in the environment, then update or insert it.  */
|      for (eep = environ; *eep; eep++)
|         if (**eep == '_' && (*eep)[1] == '=')
|             break;
| @@ -354,9 +356,11 @@
|         strcpy(buf + 2, pth);
|      else
|         sprintf(buf + 2, "%s/%s", pwd, pth);
| -    if (!*eep)
| -	eep[1] = NULL;
| -    *eep = buf;
| +    if (*eep)
| +      zputenv(buf);
| +    else
| +      *eep = buf;
| +
|      closedumps();
|      execve(pth, argv, environ);
|  

Stupid me.  Let's simplify this further by always using putenv.


Index: Src/exec.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/exec.c,v
retrieving revision 1.40
diff -u -r1.40 exec.c
--- Src/exec.c	17 Dec 2001 17:17:38 -0000	1.40
+++ Src/exec.c	29 Mar 2002 09:57:23 -0000
@@ -345,18 +345,16 @@
     for (eep = argv; *eep; eep++)
 	if (*eep != pth)
 	    unmetafy(*eep, NULL);
-    for (eep = environ; *eep; eep++)
-	if (**eep == '_' && (*eep)[1] == '=')
-	    break;
+
+    /* Update $_.  */
     buf[0] = '_';
     buf[1] = '=';
     if (*pth == '/')
 	strcpy(buf + 2, pth);
     else
 	sprintf(buf + 2, "%s/%s", pwd, pth);
-    if (!*eep)
-	eep[1] = NULL;
-    *eep = buf;
+    zputenv(buf);
+
     closedumps();
     execve(pth, argv, environ);
 
Index: Src/params.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/params.c,v
retrieving revision 1.63
diff -u -r1.63 params.c
--- Src/params.c	24 Mar 2002 23:52:49 -0000	1.63
+++ Src/params.c	29 Mar 2002 09:57:29 -0000
@@ -3125,7 +3125,8 @@
 }
 
 
-static int
+/**/
+int
 zputenv(char *str)
 {
 #ifdef HAVE_PUTENV
-- 
Alexandre Duret-Lutz