Using putenv() and later direct pointer contents modification it is possibe

to craft environment variables with similar names like that:
a=1
a=2
...
unsetenv("a") should remove them all to make later getenv("a") impossible.
Fix it to do so (this is GNU autoconf test #3 failure too).

PR:             172273
MFC after:      1 week

1 files changed, 3 insertions, 1 deletions

diff --git a/lib/libc/stdlib/getenv.c b/lib/libc/stdlib/getenv.c
index b7826d7..37602a9 100644
--- a/lib/libc/stdlib/getenv.c
+++ b/lib/libc/stdlib/getenv.c
@@ -675,11 +675,13 @@ unsetenv(const char *name)
 
 	/* Deactivate specified variable. */
 	envNdx = envVarsTotal - 1;
-	if (__findenv(name, nameLen, &envNdx, true) != NULL) {
+	/* Remove all occurrences. */
+	while (__findenv(name, nameLen, &envNdx, true) != NULL) {
 		envVars[envNdx].active = false;
 		if (envVars[envNdx].putenv)
 			__remove_putenv(envNdx);
 		__rebuild_environ(envActive - 1);
+		envNdx = envVarsTotal - 1;
 	}
 
 	return (0);