check for '=' in environment variable name in os.execve

This commit is contained in:
Minjun Shin committed 2020-08-17 02:30:26 +09:00
1 parent a35408a058
commit d992eec95a
1 file changed
+5
+5
View File
@@ -1575,6 +1575,11 @@ mod posix {
PyPathLike::try_from_object(&vm, k)?,
PyPathLike::try_from_object(&vm, v)?,
);
if key.path.display().to_string().contains('=') {
return Err(vm.new_value_error("illegal environment variable name".to_owned()));
}
ffi::CString::new(format!("{}={}", key.path.display(), value.path.display()))
.map_err(|_| vm.new_value_error("embedded null character".to_owned()))
})