(fixed in perl 5.22.2. I have changed SvREFCNT_dec_NN to SvREFCNT_dec as perl

5.12 does not have the former available. 'NN' stands for NonNull meaning that

the function can rely on a fact that input parameter is not null for better

optimization. SvREFCNT_dec is thus more general and safe to replace)

From ae37b791a73a9e78dedb89fb2429d2628cf58076 Mon Sep 17 00:00:00 2001

From: Tony Cook <[email protected]>

Date: Wed, 27 Jan 2016 11:52:15 +1100

Subject: [PATCH 1/1] remove duplicate environment variables from environ

If we see duplicate environment variables while iterating over

environ[]:

a) make sure we use the same value in %ENV that getenv() returns.

Previously on a duplicate, %ENV would have the last entry for the name

from environ[], but a typical getenv() would return the first entry.

Rather than assuming all getenv() implementations return the first entry

explicitly call getenv() to ensure they agree.

b) remove duplicate entries from environ

Previously if there was a duplicate definition for a name in environ[]

setting that name in %ENV could result in an unsafe value being passed

to a child process, so ensure environ[] has no duplicates.

CVE-2016-2381

---

 perl.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++--

 1 file changed, 49 insertions(+), 2 deletions(-)

diff --git a/perl.c b/perl.c

index 4a324c6..5c71fd0 100644

--- a/perl.c

+++ b/perl.c

@@ -4329,23 +4329,70 @@ S_init_postdump_symbols(pTHX_ int argc, char **argv, char **env)

 	}

 	if (env) {

 	  char *s, *old_var;

+          STRLEN nlen;

 	  SV *sv;

+          HV *dups = newHV();

+

 	  for (; *env; env++) {

 	    old_var = *env;

 	    if (!(s = strchr(old_var,'=')) || s == old_var)

 		continue;

+            nlen = s - old_var;

 #if defined(MSDOS) && !defined(DJGPP)

 	    *s = '\0';

 	    (void)strupr(old_var);

 	    *s = '=';

 #endif

-	    sv = newSVpv(s+1, 0);

-	    (void)hv_store(hv, old_var, s - old_var, sv, 0);

+            if (hv_exists(hv, old_var, nlen)) {

+                const char *name = savepvn(old_var, nlen);

+

+                /* make sure we use the same value as getenv(), otherwise code that

+                   uses getenv() (like setlocale()) might see a different value to %ENV

+                 */

+                sv = newSVpv(PerlEnv_getenv(name), 0);

+

+                /* keep a count of the dups of this name so we can de-dup environ later */

+                if (hv_exists(dups, name, nlen))

+                    ++SvIVX(*hv_fetch(dups, name, nlen, 0));

+                else

+                    (void)hv_store(dups, name, nlen, newSViv(1), 0);

+

+                Safefree(name);

+            }

+            else {

+                sv = newSVpv(s+1, 0);

+            }

+	    (void)hv_store(hv, old_var, nlen, sv, 0);

 	    if (env_is_not_environ)

 	        mg_set(sv);

 	  }

+          if (HvKEYS(dups)) {

+              /* environ has some duplicate definitions, remove them */

+              HE *entry;

+              hv_iterinit(dups);

+              while ((entry = hv_iternext_flags(dups, 0))) {

+                  STRLEN nlen;

+                  const char *name = HePV(entry, nlen);

+                  IV count = SvIV(HeVAL(entry));

+                  IV i;

+                  SV **valp = hv_fetch(hv, name, nlen, 0);

+

+                  assert(valp);

+

+                  /* try to remove any duplicate names, depending on the

+                   * implementation used in my_setenv() the iteration might

+                   * not be necessary, but let's be safe.

+                   */

+                  for (i = 0; i < count; ++i)

+                      my_setenv(name, 0);

+

+                  /* and set it back to the value we set $ENV{name} to */

+                  my_setenv(name, SvPV_nolen(*valp));

+              }

+          }

+          SvREFCNT_dec(dups);

       }

 #endif /* USE_ENVIRON_ARRAY */

 #endif /* !PERL_MICRO */

-- 

2.8.2-513-g68575d3