From owner-svn-src-stable@FreeBSD.ORG  Fri Oct 12 13:17:20 2012
Return-Path: <owner-svn-src-stable@FreeBSD.ORG>
Delivered-To: svn-src-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
 by hub.freebsd.org (Postfix) with ESMTP id 666FBDDA;
 Fri, 12 Oct 2012 13:17:20 +0000 (UTC)
 (envelope-from ache@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
 by mx1.freebsd.org (Postfix) with ESMTP id 4E2B08FC08;
 Fri, 12 Oct 2012 13:17:20 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
 by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q9CDHKGo009412;
 Fri, 12 Oct 2012 13:17:20 GMT (envelope-from ache@svn.freebsd.org)
Received: (from ache@localhost)
 by svn.freebsd.org (8.14.4/8.14.4/Submit) id q9CDHKtY009410;
 Fri, 12 Oct 2012 13:17:20 GMT (envelope-from ache@svn.freebsd.org)
Message-Id: <201210121317.q9CDHKtY009410@svn.freebsd.org>
From: "Andrey A. Chernov" <ache@FreeBSD.org>
Date: Fri, 12 Oct 2012 13:17:20 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org
Subject: svn commit: r241483 - stable/9/lib/libc/stdlib
X-SVN-Group: stable-9
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-stable@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for all the -stable branches of the src tree
 <svn-src-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-stable>,
 <mailto:svn-src-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-stable>
List-Post: <mailto:svn-src-stable@freebsd.org>
List-Help: <mailto:svn-src-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-stable>,
 <mailto:svn-src-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 12 Oct 2012 13:17:20 -0000

Author: ache
Date: Fri Oct 12 13:17:19 2012
New Revision: 241483
URL: http://svn.freebsd.org/changeset/base/241483

Log:
  MFC r241137,r241154
  
  Using putenv() and later direct pointer contents modification it is possibe
  to craft environment variables with similar names like that:
  a=1
  a=2
  ...
  unsetenv("a") should remove them all to make later getenv("a") impossible.
  Fix it to do so (this is GNU autoconf test #3 failure too).
  
  PR:             172273

Modified:
  stable/9/lib/libc/stdlib/getenv.c
Directory Properties:
  stable/9/lib/libc/   (props changed)

Modified: stable/9/lib/libc/stdlib/getenv.c
==============================================================================
--- stable/9/lib/libc/stdlib/getenv.c	Fri Oct 12 12:27:30 2012	(r241482)
+++ stable/9/lib/libc/stdlib/getenv.c	Fri Oct 12 13:17:19 2012	(r241483)
@@ -662,6 +662,7 @@ unsetenv(const char *name)
 {
 	int envNdx;
 	size_t nameLen;
+	int newEnvActive;
 
 	/* Check for malformed name. */
 	if (name == NULL || (nameLen = __strleneq(name)) == 0) {
@@ -674,13 +675,18 @@ unsetenv(const char *name)
 		return (-1);
 
 	/* Deactivate specified variable. */
+	/* Remove all occurrences. */
 	envNdx = envVarsTotal - 1;
-	if (__findenv(name, nameLen, &envNdx, true) != NULL) {
+	newEnvActive = envActive;
+	while (__findenv(name, nameLen, &envNdx, true) != NULL) {
 		envVars[envNdx].active = false;
 		if (envVars[envNdx].putenv)
 			__remove_putenv(envNdx);
-		__rebuild_environ(envActive - 1);
+		envNdx--;
+		newEnvActive--;
 	}
+	if (newEnvActive != envActive)
+		__rebuild_environ(newEnvActive);
 
 	return (0);
 }