Path: csiph.com!xmission!news.snarked.org!news.linkpendium.com!news.linkpendium.com!panix!usenet.stanford.edu!not-for-mail
From: Keeley Hoek <keeley@hoek.io>
Newsgroups: gnu.bash.bug
Subject: [PATCH] Fix null environ crash in getenv() provided by lib/sh/getenv.c
Date: Sun, 8 Jul 2018 21:21:21 +1000
Lines: 34
Sender: keeley@hoek.io
Approved: bug-bash@gnu.org
Message-ID: <mailman.3251.1531054800.1292.bug-bash@gnu.org>
NNTP-Posting-Host: lists.gnu.org
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
To: bug-bash@gnu.org
Envelope-to: bug-bash@gnu.org
Precedence: list
Xref: csiph.com gnu.bash.bug:14299

In running bash on an embedded target, bash crashes for the silly
reason that environ is NULL.

I haven't been able to tell whether this is actually permitted by the
standard (as if?), but in bash I think this behavior is inconsistent
anyway because:

   * in initialize_shell_variables() from variables.c on line 344 the
"env == NULL" case is guarded against, while
   * in getenv() from lib/sh/getenv.c on line 81 access to environ is
performed unprotected.

Attached below is the tiny modification required to prevent the
segfault which occurs in the latter case. Of course, the extra
condition is only checked when "shell_variables == NULL", which is
true only before initialization has been completed. Would you consider
the addition of this protection at all acceptable?

Kind regards,
Keeley Hoek

diff --git a/lib/sh/getenv.c b/lib/sh/getenv.c
index 8b5e3406..1e682aef 100644
--- a/lib/sh/getenv.c
+++ b/lib/sh/getenv.c
@@ -69,7 +69,7 @@ getenv (name)
       if (var && exported_p (var))
        return (value_cell (var));
     }
-  else
+  else if (environ)
     {
       register int i, len;