This small program crashes glibc in execvp():

---------------------------------------------------
#include <unistd.h>

extern char **environ;
static char *empty[] = { 0 };

int main (void)
{
  environ = empty;
  execvp ("nothing ", empty);
  return 0;
}
---------------------------------------------------

$ ./a.out 
*** glibc detected *** free(): invalid pointer: 0x0000000000501016 ***
Aborted (core dumped)
$ 

similar effect can be achieved by executing "env -i nonexistent_program".

the problem seems to be here, posix/execvp.c:121:

      char *p = path;
      do
	{
	  char *startp;

	  path = p;                      // it changes 'path' inside loop
	  p = __strchrnul (path, ':');

          ...

	}
      while (*p++ != '\0');
      ...

      if (path_malloc)
	free (path);                     // and then frees it.