@samitouri / QOSamiQemu / commits / c131ae56c1

util/envlist: fix prefix-match in envlist_unsetenv() name lookup

envlist_unsetenv() looked up the entry to remove with strncmp(entry->ev_var, env, strlen(env)). The comparison length is the requested name's length, so any stored entry whose name *starts* with that name compares equal. envlist_setenv() inserts at the head of the list, so the first hit wins: with FOO=... stored first and FOOBAR=... stored afterward, envlist_unsetenv("FOO") iterates from the head, matches FOOBAR=... on the prefix, and drops it instead of FOO=... linux-user and bsd-user reach this code via the -U command-line switch, so the bug is reachable from a normal qemu-user invocation. envlist_setenv() used the same strncmp pattern but with envname_len = (eq_sign - env + 1), so the '=' byte sat inside the compared window and acted as an implicit boundary. setenv was therefore not buggy -- but the safety lived in the byte layout of ev_var rather than in the entry, so a future edit could easily drift the two sites apart again. Store the name length on each entry at insertion time and compare with explicit length equality plus memcmp via a small helper. Use the helper at both lookup sites so the boundary becomes a structural property of the entry: envlist_unsetenv() stops prefix-matching, and envlist_setenv()'s self-search no longer depends on the '=' byte serving as a sentinel. Fixes: 04a6dfebb6b5 ("linux-user: Add generic env variable handling") Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20260520212628.479772-2-den@openvz.org Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Denis V. Lunev committed May 20, 2026 at 23:26 UTC c131ae56c13ffe6bd7089cf0d9bd00a7c2dbc71f

1 file changed +15 -4

util/envlist.c

+15 -4

@@ -3,7 +3,8 @@

3 #include "qemu/envlist.h"

5 struct envlist_entry {

6 - const char *ev_var; /* actual env value */

6 + const char *ev_var; /* actual env value: "NAME=VALUE" */

7 + size_t ev_name_len; /* length of NAME (offset of '=') */

8 QLIST_ENTRY(envlist_entry) ev_link;

9 };

@@ -12,6 +13,13 @@ struct envlist {

13 size_t el_count; /* number of entries */

14 };

16 +static inline bool envlist_name_eq(const struct envlist_entry *entry,

17 + const char *name, size_t name_len)

18 +{

19 + return entry->ev_name_len == name_len &&

20 + memcmp(entry->ev_var, name, name_len) == 0;

21 +}

22 +

23 /*

24 * Allocates new envlist and returns pointer to it.

25 */

@@ -67,7 +75,7 @@ envlist_setenv(envlist_t *envlist, const char *env)

75 /* find out first equals sign in given env */

76 if ((eq_sign = strchr(env, '=')) == NULL)

77 return (EINVAL);

70 - envname_len = eq_sign - env + 1;

78 + envname_len = eq_sign - env;

80 /*

81 * If there already exists variable with given name

@@ -76,8 +84,9 @@ envlist_setenv(envlist_t *envlist, const char *env)

84 */

85 for (entry = envlist->el_entries.lh_first; entry != NULL;

86 entry = entry->ev_link.le_next) {

79 - if (strncmp(entry->ev_var, env, envname_len) == 0)

87 + if (envlist_name_eq(entry, env, envname_len)) {

88 break;

89 + }

90 }

92 if (entry != NULL) {

@@ -90,6 +99,7 @@ envlist_setenv(envlist_t *envlist, const char *env)

100 entry = g_malloc(sizeof(*entry));

101 entry->ev_var = g_strdup(env);

102 + entry->ev_name_len = envname_len;

103 QLIST_INSERT_HEAD(&envlist->el_entries, entry, ev_link);

104

105 return (0);

@@ -119,8 +129,9 @@ envlist_unsetenv(envlist_t *envlist, const char *env)

129 envname_len = strlen(env);

130 for (entry = envlist->el_entries.lh_first; entry != NULL;

131 entry = entry->ev_link.le_next) {

122 - if (strncmp(entry->ev_var, env, envname_len) == 0)

132 + if (envlist_name_eq(entry, env, envname_len)) {

133 break;

134 + }

135 }

136 if (entry != NULL) {

137 QLIST_REMOVE(entry, ev_link);