Hello Alexander,

Thanks for this pointer. This UB and a similar one in putenv were going to be our next report:

unsetenv:
* rewrite; this fixes UB caused by testing a free'd pointer against
  NULL on entry to subsequent loops.

In the version after your patch, we do not detect any undefined behavior with TIS Interpreter, for the tests we have (libc-testsuite plus one additional test that we wrote to make TIS Interpreter confirm the misuse of memcmp in putenv).

Pascal

On 21 Aug 2017, at 10:02, Alexander Monakov <amonakov@ispras.ru<mailto:amonakov@ispras.ru>> wrote:

*env functions have multiple issues including other UB and a memory leak.

http://openwall.com/lists/musl/2016/03/13/7

Alexander