Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 22 Apr 2015 21:26:57 -0400
From: Jean-Marc Pigeon <>
Subject: Re: setenv if value=NULL, what say standard? Bug?

Hash: SHA1

On 04/22/2015 08:35 PM, Laurent Bercot wrote:
> On 23/04/2015 02:08, Jean-Marc Pigeon wrote:
>> My guess, glibc code is 'blindly" setting the NULL (as "") value
>> to the variable.
>> Is the standard saying otherwise, or do we have a a real bug in
>> setenv??
> The standard at 
> ... exactly nothing about the possibility of envval being NULL. 
> This is, in the strictest sense, UB. :)
> Actually, it says "The environment variable shall be set to the
> value to which envval points." So, arguably, envval should point to
> something, and since NULL does not, it is forbidden. Another valid
> interpretation could be that envvar is set to the value to which
> envval points, i.e. no value at all, so it is unset; but it doesn't
> fit the spirit of setenv() to unset variables. The glibc
> interpretation, if it does what you think it does, is wrong in any
> case: the empty string is a very different thing from no value at
> all.
> I think the only safe conclusion is that the application is
> incorrect and should ensure that setenv() is never called with a
> NULL value.
Checked glibc, My understanding, it set something as
in the environment, so the variable is present but
value is "empty"i (top application to decide what to do).
uclibc does something similar (as far I can tell looking
at source code)..

The application is not careful enough, but not incorrect as such.
Note: we may have tons of applications with the same problem.
if we keep musl setenv like that, musl will be seen as quite unreliable.

If this situation is indeed UB, there is 2 options for musl:
1) Swallow the problem nicely... as glibc and uclibc does.
2) Report an error.. EINVAL? (and document it in manual)

Crashing at "libc" level is not an option.

- -- 

A bientôt
Jean-Marc Pigeon                        E-Mail:
SAFE Inc.                             Phone: (514) 493-4280
  Clement, 'a kiss solution' to get rid of SPAM (at last)
     Clement' Home base <"">
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird -


Download attachment "smime.p7s" of type "application/pkcs7-signature" (4242 bytes)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.