diff options
author | Damien Miller <djm@mindrot.org> | 2014-03-04 09:35:17 +1100 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2014-03-04 09:35:17 +1100 |
commit | 8569eba5d7f7348ce3955eeeb399f66f25c52ece (patch) | |
tree | 76d21af5de19f44ccc95ce5900f293ab84eb605a /session.c | |
parent | 2476c31b96e89aec7d4e73cb6fbfb9a4290de3a7 (diff) | |
download | openssh-git-8569eba5d7f7348ce3955eeeb399f66f25c52ece.tar.gz |
- djm@cvs.openbsd.org 2014/03/03 22:22:30
[session.c]
ignore enviornment variables with embedded '=' or '\0' characters;
spotted by Jann Horn; ok deraadt@
Diffstat (limited to 'session.c')
-rw-r--r-- | session.c | 9 |
1 files changed, 7 insertions, 2 deletions
@@ -978,6 +978,11 @@ child_set_env(char ***envp, u_int *envsizep, const char *name, u_int envsize; u_int i, namelen; + if (strchr(name, '=') != NULL) { + error("Invalid environment variable \"%.100s\"", name); + return; + } + /* * If we're passed an uninitialized list, allocate a single null * entry before continuing. @@ -2225,8 +2230,8 @@ session_env_req(Session *s) char *name, *val; u_int name_len, val_len, i; - name = packet_get_string(&name_len); - val = packet_get_string(&val_len); + name = packet_get_cstring(&name_len); + val = packet_get_cstring(&val_len); packet_check_eom(); /* Don't set too many environment variables */ |