getenv

Author: LamentXU123

NEWS

@@ -170,6 +170,8 @@ PHP                                                                        NEWS
     argument value is passed. (Girgias)
   . linkinfo() now raises a ValueError when the argument is an empty string.
     (Weilin Du)
+  . getenv() now raises a ValueError when the $name argument contains null
+    bytes. (Weilin Du)
   . putenv() now raises a ValueError when the $assignment argument contains
     null bytes. (Weilin Du)
 

UPGRADING

@@ -88,6 +88,8 @@ PHP 8.6 UPGRADE NOTES
     argument value is passed.
   . array_change_key_case() now raises a ValueError when an invalid $case
     argument value is passed.
+  . getenv() now raises a ValueError when the $name argument contains null
+    bytes.
   . putenv() now raises a ValueError when the $assignment argument contains
     null bytes.
   . linkinfo() now raises a ValueError when the $path argument is empty.

ext/standard/basic_functions.c

@@ -706,6 +706,11 @@ PHP_FUNCTION(getenv)
 		return;
 	}
 
+	if (UNEXPECTED(memchr(str, '\0', str_len) != NULL)) {
+		zend_argument_value_error(1, "must not contain any null bytes");
+		RETURN_THROWS();
+	}
+
 	if (!local_only) {
 		/* SAPI method returns an emalloc()'d string */
 		char *ptr = sapi_getenv(str, str_len);
@@ -742,7 +747,7 @@ PHP_FUNCTION(putenv)
 		Z_PARAM_STRING(setting, setting_len)
 	ZEND_PARSE_PARAMETERS_END();
 
-	if (memchr(setting, '\0', setting_len) != NULL) {
+	if (UNEXPECTED(memchr(setting, '\0', setting_len) != NULL)) {
 		zend_argument_value_error(1, "must not contain any null bytes");
 		RETURN_THROWS();
 	}

ext/standard/tests/general_functions/getenv_null_bytes.phpt

@@ -0,0 +1,17 @@
+--TEST--
+getenv() rejects null bytes
+--FILE--
+<?php
+
+foreach ([false, true] as $local_only) {
+    try {
+        getenv("PHP_GETENV_NUL_TEST\0SUFFIX", $local_only);
+    } catch (ValueError $exception) {
+        echo $exception->getMessage() . "\n";
+    }
+}
+
+?>
+--EXPECT--
+getenv(): Argument #1 ($name) must not contain any null bytes
+getenv(): Argument #1 ($name) must not contain any null bytes