[PATCH] stdlib: Support malloc-managed environ arrays for compatibility

[Sam James]

"H.J. Lu" <hjl.tools@gmail.com> writes:

> On Wed, Jan 22, 2025 at 8:49 PM Florian Weimer <fweimer@redhat.com> wrote:
>>
>> Some allocations set environ to a heap-allocated pointer, call
>> setenv (expecting it to call realloc), free environ, and then
>> restore the original environ pointer.  This breaks after
>> commit 7a61e7f557a97ab597d6fca5e2d1f13f65685c61 ("stdlib: Make
>> getenv thread-safe in more cases") because after the setenv call,
>> the environ pointer does not point to the start of a heap allocation.
>> Instead, setenv creates a separate allocation and changes environ
>> to point into that.  This means that the free call in the application
>> results in heap corruption.
>>
>> The interim approach was more compatible with other libcs because
>> it does not assume that the incoming environ pointer is allocated
>> as if by malloc (if it was written by the application).  However,
>> it seems to be more important to stay compatible with previous
>> glibc version: assume the incoming pointer is heap allocated,
>> and preserve this property after setenv calls.
>>
>> Tested on x86_64-linux-gnu.
>>
>> I'd prefer to get this into the upcoming
>> release if possible, assuming that I can get a review in a timely
>> fashion.
>>
>> Thanks,
>> Florian
>>
>> ---
>>  csu/init-first.c           |  1 +
>>  csu/libc-start.c           |  1 +
>>  include/unistd.h           |  3 +++
>>  posix/environ.c            |  2 ++
>>  stdlib/Makefile            |  1 +
>>  stdlib/setenv.c            | 64 +++++++++++++++++++++++-----------------------
>>  stdlib/tst-setenv-malloc.c | 64 ++++++++++++++++++++++++++++++++++++++++++++++
>>  7 files changed, 104 insertions(+), 32 deletions(-)
>>
>
> On x32, I got
>
> [hjl@gnu-tgl-3 glibc-x32-cet]$ env -i
> LOCPATH=/export/build/gnu/tools-build/glibc-x32-cet/build-x86_64-linux/localedata/
> LC_CTYPE=de_DE.UTF-8
> /export/build/gnu/tools-build/glibc-x32-cet/build-x86_64-linux/localedata/bug-setlocale1
> realloc(): invalid pointer
> Aborted (core dumped)
> [hjl@gnu-tgl-3 glibc-x32-cet]$

See PR32588 (though I think we should analyse localedata/bug-setlocale1.c here).