From 3972a13475c771a57958d1db9994e1ebe6cdfc47 Mon Sep 17 00:00:00 2001 From: ache Date: Fri, 20 Oct 1995 17:26:40 +0000 Subject: Don't allow LD_* env. variables to be tricked Submitted by: Sam Hartman --- libexec/telnetd/sys_term.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'libexec') diff --git a/libexec/telnetd/sys_term.c b/libexec/telnetd/sys_term.c index c2388b5..79b9313 100644 --- a/libexec/telnetd/sys_term.c +++ b/libexec/telnetd/sys_term.c @@ -1555,6 +1555,8 @@ start_login(host, autologin, name) fatal(net, "makeutx failed"); #endif + scrub_env(); + /* * -h : pass on name of host. * WARNING: -h is accepted by login if and only if @@ -1768,6 +1770,26 @@ addarg(argv, val) #endif /* NEWINIT */ /* + * scrub_env() + * + * Remove a few things from the environment that + * don't need to be there. + */ +scrub_env() +{ + register char **cpp, **cpp2; + + for (cpp2 = cpp = environ; *cpp; cpp++) { + if (!strncmp(*cpp, "LD_", 3) && + !strncmp(*cpp, "_RLD_", 5) && + !strncmp(*cpp, "LIBPATH=", 8) && + !strncmp(*cpp, "IFS=", 4)) + *cpp2++ = *cpp; + } + *cpp2 = 0; +} + +/* * cleanup() * * This is the routine to call when we are all through, to -- cgit v1.1