[patch] Fix BZ #18043 (comment #19)

[Paul Pluzhnikov]

Greetings,

Calling 'setenv(..., NULL, 1)' invokes undefined behavior.

Unfortunately, wordexp() itself does it, triggering subsequent buffer overflow.
See http://sourceware.org/bugzilla/show_bug.cgi?id=18043#c19.

Attached trivial patch stops wordexp from doing that.


2015-03-09  Paul Pluzhnikov  <ppluzhnikov@google.com>

        [BZ #18043]
        * posix/wordexp.c (parse_param): Don't call setenv(..., NULL, 1).




-- 
Paul Pluzhnikov
-------------- next part --------------
diff --git a/posix/wordexp.c b/posix/wordexp.c
index f470e08..f6062d5 100644
--- a/posix/wordexp.c
+++ b/posix/wordexp.c
@@ -1915,7 +1915,7 @@ envsubst:
 	  if (pattern && !value)
 	    goto no_space;
 
-	  __setenv (env, value, 1);
+	  __setenv (env, value ?: "", 1);
 	  break;
 
 	default: