RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-14 09:24:57 +00:00
Code Issues Activity Actions

LibC: Do not crash if putenv variable is invalid

Browse source 
Dr. POSIX says:

    Although the space used by string is no longer used once a new
    string which defines name is passed to putenv(), if any thread in
    the application has used getenv() to retrieve a pointer to this
    variable, it should not be freed by calling free(). If the changed
    environment variable is one known by the system (such as the locale
    environment variables) the application should never free the buffer
    used by earlier calls to putenv() for the same variable.

Applications _should_ not free the data passed to `putenv`, but they
_could_ in practice. I found that our Quake II port misbehaves in this
way, but does not crash on other platforms because glibc/musl `putenv`
does not assume that environment variables are correctly formatted.

The new behavior ignores environment variables without a '=' present,
and prevents excessively reading beyond the variable's name if the data
pointed to by the environment entry does not contain any null bytes.

With this change, our Quake II port no longer crashes when switching
from fullscreen to windowed mode.
This commit is contained in:
Jelle Raaijmakers 2023-06-04 00:56:16 +02:00 • committed by Andreas Kling
parent 2420effa7d
commit f081a89cd9
3 changed files with 70 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

21
Userland/Libraries/LibC/stdlib.cpp
View file

@ -414,9 +414,8 @@ char* getenv(char const* name)
size_t varLength = eq - decl;
if (vl != varLength)
continue;
if (strncmp(decl, name, varLength) == 0) {
if (strncmp(decl, name, varLength) == 0)
return eq + 1;
}
}
return nullptr;
}
@ -493,22 +492,23 @@ int serenity_putenv(char const* new_var, size_t length)
int putenv(char* new_var)
{
char* new_eq = strchr(new_var, '=');
if (!new_eq)
return unsetenv(new_var);
auto new_var_len = new_eq - new_var;
auto new_var_name_len = new_eq - new_var;
int environ_size = 0;
for (; environ[environ_size]; ++environ_size) {
char* old_var = environ[environ_size];
char* old_eq = strchr(old_var, '=');
VERIFY(old_eq);
auto old_var_len = old_eq - old_var;
auto old_var_name_max_length = strnlen(old_var, new_var_name_len);
char* old_eq = static_cast<char*>(memchr(old_var, '=', old_var_name_max_length + 1));
if (!old_eq)
continue; // possibly freed or overwritten value
if (new_var_len != old_var_len)
auto old_var_name_len = old_eq - old_var;
if (new_var_name_len != old_var_name_len)
continue; // can't match
if (strncmp(new_var, old_var, new_var_len) == 0) {
if (strncmp(new_var, old_var, new_var_name_len) == 0) {
free_environment_variable_if_needed(old_var);
environ[environ_size] = new_var;
return 0;
@ -523,9 +523,8 @@ int putenv(char* new_var)
return -1;
}
for (int i = 0; environ[i]; ++i) {
for (int i = 0; environ[i]; ++i)
new_environ[i] = environ[i];
}
new_environ[environ_size] = new_var;
new_environ[environ_size + 1] = nullptr;