#44836 [Opn->Asn]: [PATCH] putenv() crashes, avoid direct reference of environ in POSIX systems

ID: 44836 Updated by: tony2001@php.net Reported By: delphij at FreeBSD dot org -Status: Open +Status: Assigned Bug Type: Reproducible crash Operating System: FreeBSD 7.0 PHP Version: 5.2.5 -Assigned To: +Assigned To: iliaa Previous Comments: ------------------------------------------------------------------------ [2008-05-07 08:42:58] tony2001@php.net Your patch causes crashes on Linux, please revert. ------------------------------------------------------------------------ [2008-05-06 18:04:30] iliaa@php.net This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. ------------------------------------------------------------------------ [2008-04-25 23:50:49] delphij at FreeBSD dot org Description: ------------ PHP would crash in certain cases where putenv() is being called, in POSIX systems which calls free() in putenv(). The following patch always duplicate the environment from the environment instead of relying on that they are invariant. --- ext/standard/basic_functions.c.orig 2008-04-25 16:26:14.885468614 -0700 +++ ext/standard/basic_functions.c 2008-04-25 16:32:46.215744075 -0700 @@ -3861,9 +3862,7 @@ SetEnvironmentVariable(pe->key, "bugbug"); #endif putenv(pe->previous_value); -# if defined(PHP_WIN32) efree(pe->previous_value); -# endif } else { # if HAVE_UNSETENV unsetenv(pe->key); @@ -4463,12 +4462,8 @@ pe.previous_value = NULL; for (env = environ; env != NULL && *env != NULL; env++) { if (!strncmp(*env, pe.key, pe.key_len) && (*env)[pe.key_len] == '=') { /* found it */ -#if defined(PHP_WIN32) /* must copy previous value because MSVCRT's putenv can free the string without notice */ pe.previous_value = estrdup(*env); -#else - pe.previous_value = *env; -#endif break; } } ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=44836&edit=1