Protect against string overrun when calling unsetenv.

2 files changed, 10 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index a1bfc3a3..68c5719a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 2017-01-26         Andrew J. Schorr     <aschorr@telemetry-investments.com>
 
+	* str_array.c (env_remove): Terminate string before calling unsetenv.
+
+2017-01-26         Andrew J. Schorr     <aschorr@telemetry-investments.com>
+
 	* node.c (is_hex): Add a new argument pointing to the end of the string
 	so we can check for string overrun.
 	(r_force_number): Pass string end to is_hex.
diff --git a/str_array.c b/str_array.c
index d832380d..c559a39a 100644
--- a/str_array.c
+++ b/str_array.c
@@ -773,9 +773,14 @@ static NODE **
 env_remove(NODE *symbol, NODE *subs)
 {
 	NODE **val = str_remove(symbol, subs);
+	char save;
 
-	if (val != NULL)
+	if (val != NULL) {
+		save = subs->stptr[subs->stlen];
+		subs->stptr[subs->stlen] = '\0';
 		(void) unsetenv(subs->stptr);
+		subs->stptr[subs->stlen] = save;
+	}
 
 	return val;
 }