fix parent-memory-clobber in posix_spawn (environ)

3 files changed, 17 insertions, 9 deletions

diff --git a/src/process/execvp.c b/src/process/execvp.c
index b2da44b9..682680dd 100644
--- a/src/process/execvp.c
+++ b/src/process/execvp.c
@@ -4,7 +4,9 @@
 #include <errno.h>
 #include <limits.h>
 
-int execvp(const char *file, char *const argv[])
+extern char **environ;
+
+int __execvpe(const char *file, char *const argv[], char *const envp[])
 {
 	const char *p, *z, *path = getenv("PATH");
 	size_t l, k;
@@ -13,7 +15,7 @@ int execvp(const char *file, char *const argv[])
 	if (!*file) return -1;
 
 	if (strchr(file, '/'))
-		return execv(file, argv);
+		return execve(file, argv, envp);
 
 	if (!path) path = "/usr/local/bin:/bin:/usr/bin";
 	k = strnlen(file, NAME_MAX+1);
@@ -34,9 +36,14 @@ int execvp(const char *file, char *const argv[])
 		memcpy(b, p, z-p);
 		b[z-p] = '/';
 		memcpy(b+(z-p)+(z>p), file, k+1);
-		execv(b, argv);
+		execve(b, argv, envp);
 		if (errno != ENOENT) return -1;
 		if (!*z++) break;
 	}
 	return -1;
 }
+
+int execvp(const char *file, char *const argv[])
+{
+	return __execvpe(file, argv, environ);
+}
diff --git a/src/process/posix_spawn.c b/src/process/posix_spawn.c
index e8557487..c3e800b8 100644
--- a/src/process/posix_spawn.c
+++ b/src/process/posix_spawn.c
@@ -19,7 +19,7 @@ weak_alias(dummy_0, __release_ptc);
 pid_t __vfork(void);
 
 int __posix_spawnx(pid_t *restrict res, const char *restrict path,
-	int (*exec)(const char *, char *const *),
+	int (*exec)(const char *, char *const *, char *const *),
 	const posix_spawn_file_actions_t *fa,
 	const posix_spawnattr_t *restrict attr,
 	char *const argv[restrict], char *const envp[restrict])
@@ -95,8 +95,7 @@ int __posix_spawnx(pid_t *restrict res, const char *restrict path,
 	sigprocmask(SIG_SETMASK, (attr->__flags & POSIX_SPAWN_SETSIGMASK)
 		? &attr->__mask : &oldmask, 0);
 
-	if (envp) environ = (char **)envp;
-	exec(path, argv);
+	exec(path, argv, envp ? envp : environ);
 	_exit(127);
 
 	return 0;
@@ -107,5 +106,5 @@ int posix_spawn(pid_t *restrict res, const char *restrict path,
 	const posix_spawnattr_t *restrict attr,
 	char *const argv[restrict], char *const envp[restrict])
 {
-	return __posix_spawnx(res, path, execv, fa, attr, argv, envp);
+	return __posix_spawnx(res, path, execve, fa, attr, argv, envp);
 }
diff --git a/src/process/posix_spawnp.c b/src/process/posix_spawnp.c
index 91355fb8..37360001 100644
--- a/src/process/posix_spawnp.c
+++ b/src/process/posix_spawnp.c
@@ -1,8 +1,10 @@
 #include <spawn.h>
 #include <unistd.h>
 
+int __execvpe(const char *, char *const *, char *const *);
+
 int __posix_spawnx(pid_t *restrict, const char *restrict,
-	int (*)(const char *, char *const *),
+	int (*)(const char *, char *const *, char *const *),
 	const posix_spawn_file_actions_t *,
 	const posix_spawnattr_t *restrict, char *const *restrict, char *const *restrict);
 
@@ -11,5 +13,5 @@ int posix_spawnp(pid_t *restrict res, const char *restrict file,
 	const posix_spawnattr_t *restrict attr,
 	char *const argv[restrict], char *const envp[restrict])
 {
-	return __posix_spawnx(res, file, execvp, fa, attr, argv, envp);
+	return __posix_spawnx(res, file, __execvpe, fa, attr, argv, envp);
 }