901-CVE-2016-2381.patch (3478B)
1 From: Tony Cook <tony@develop-help.com> 2 Date: Wed, 27 Jan 2016 00:52:15 +0000 (+1100) 3 Subject: remove duplicate environment variables from environ 4 X-Git-Url: http://perl5.git.perl.org/perl.git/commitdiff_plain/ae37b791a73a9e78dedb89fb2429d2628cf58076 5 6 remove duplicate environment variables from environ 7 8 If we see duplicate environment variables while iterating over 9 environ[]: 10 11 a) make sure we use the same value in %ENV that getenv() returns. 12 13 Previously on a duplicate, %ENV would have the last entry for the name 14 from environ[], but a typical getenv() would return the first entry. 15 16 Rather than assuming all getenv() implementations return the first entry 17 explicitly call getenv() to ensure they agree. 18 19 b) remove duplicate entries from environ 20 21 Previously if there was a duplicate definition for a name in environ[] 22 setting that name in %ENV could result in an unsafe value being passed 23 to a child process, so ensure environ[] has no duplicates. 24 25 CVE-2016-2381 26 --- 27 28 --- a/perl.c 29 +++ b/perl.c 30 @@ -4298,23 +4298,70 @@ S_init_postdump_symbols(pTHX_ int argc, 31 } 32 if (env) { 33 char *s, *old_var; 34 + STRLEN nlen; 35 SV *sv; 36 + HV *dups = newHV(); 37 + 38 for (; *env; env++) { 39 old_var = *env; 40 41 if (!(s = strchr(old_var,'=')) || s == old_var) 42 continue; 43 + nlen = s - old_var; 44 45 #if defined(MSDOS) && !defined(DJGPP) 46 *s = '\0'; 47 (void)strupr(old_var); 48 *s = '='; 49 #endif 50 - sv = newSVpv(s+1, 0); 51 - (void)hv_store(hv, old_var, s - old_var, sv, 0); 52 + if (hv_exists(hv, old_var, nlen)) { 53 + const char *name = savepvn(old_var, nlen); 54 + 55 + /* make sure we use the same value as getenv(), otherwise code that 56 + uses getenv() (like setlocale()) might see a different value to %ENV 57 + */ 58 + sv = newSVpv(PerlEnv_getenv(name), 0); 59 + 60 + /* keep a count of the dups of this name so we can de-dup environ later */ 61 + if (hv_exists(dups, name, nlen)) 62 + ++SvIVX(*hv_fetch(dups, name, nlen, 0)); 63 + else 64 + (void)hv_store(dups, name, nlen, newSViv(1), 0); 65 + 66 + Safefree(name); 67 + } 68 + else { 69 + sv = newSVpv(s+1, 0); 70 + } 71 + (void)hv_store(hv, old_var, nlen, sv, 0); 72 if (env_is_not_environ) 73 mg_set(sv); 74 } 75 + if (HvKEYS(dups)) { 76 + /* environ has some duplicate definitions, remove them */ 77 + HE *entry; 78 + hv_iterinit(dups); 79 + while ((entry = hv_iternext_flags(dups, 0))) { 80 + STRLEN nlen; 81 + const char *name = HePV(entry, nlen); 82 + IV count = SvIV(HeVAL(entry)); 83 + IV i; 84 + SV **valp = hv_fetch(hv, name, nlen, 0); 85 + 86 + assert(valp); 87 + 88 + /* try to remove any duplicate names, depending on the 89 + * implementation used in my_setenv() the iteration might 90 + * not be necessary, but let's be safe. 91 + */ 92 + for (i = 0; i < count; ++i) 93 + my_setenv(name, 0); 94 + 95 + /* and set it back to the value we set $ENV{name} to */ 96 + my_setenv(name, SvPV_nolen(*valp)); 97 + } 98 + } 99 + SvREFCNT_dec_NN(dups); 100 } 101 #endif /* USE_ENVIRON_ARRAY */ 102 #endif /* !PERL_MICRO */