Skip to content

Commit 370627c

Browse files
committed
mingw: be more defensive when making the environment block
Outside of our Windows-specific code, the end of the environment can be marked also by a pointer to a NUL character, not only by a NULL pointer as our code assumed so far. That led to a buffer overrun in `make_environment_block()` when running `git-remote-https` in `mintty` (because `curl_global_init()` added the `CHARSET` environment variable *outside* of `mingw_putenv()`, ending the environment in a pointer to an empty string). Side note for future debugging on Windows: when running programs in `mintty`, the standard input/output/error is not connected to a Win32 Console, but instead is pipe()d. That means that even stderr may not be written completely before a crash, but has to be fflush()ed explicitly. For example, when debugging crashes, the developer should insert an `fflush(stderr);` at the end of the `error()` function defined in usage.c. Signed-off-by: Johannes Schindelin <[email protected]>
1 parent b2d2e0a commit 370627c

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

compat/mingw.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1026,19 +1026,19 @@ static wchar_t *make_environment_block(char **deltaenv)
10261026
char **tmpenv;
10271027
int i = 0, size = environ_size, wenvsz = 0, wenvpos = 0;
10281028

1029-
while (deltaenv && deltaenv[i])
1029+
while (deltaenv && deltaenv[i] && *deltaenv[i])
10301030
i++;
10311031

10321032
/* copy the environment, leaving space for changes */
10331033
tmpenv = xmalloc((size + i) * sizeof(char*));
10341034
memcpy(tmpenv, environ, size * sizeof(char*));
10351035

10361036
/* merge supplied environment changes into the temporary environment */
1037-
for (i = 0; deltaenv && deltaenv[i]; i++)
1037+
for (i = 0; deltaenv && deltaenv[i] && *deltaenv[i]; i++)
10381038
size = do_putenv(tmpenv, deltaenv[i], size, 0);
10391039

10401040
/* create environment block from temporary environment */
1041-
for (i = 0; tmpenv[i]; i++) {
1041+
for (i = 0; tmpenv[i] && *tmpenv[i]; i++) {
10421042
size = 2 * strlen(tmpenv[i]) + 2; /* +2 for final \0 */
10431043
ALLOC_GROW(wenvblk, (wenvpos + size) * sizeof(wchar_t), wenvsz);
10441044
wenvpos += xutftowcs(&wenvblk[wenvpos], tmpenv[i], size) + 1;

0 commit comments

Comments
 (0)