Skip to content

Throw a ValueError when the parameter includes NUL bytes in putenv and getenv#21817

Open
LamentXU123 wants to merge 6 commits intophp:masterfrom
LamentXU123:bug-fix
Open

Throw a ValueError when the parameter includes NUL bytes in putenv and getenv#21817
LamentXU123 wants to merge 6 commits intophp:masterfrom
LamentXU123:bug-fix

Conversation

@LamentXU123
Copy link
Copy Markdown
Contributor

@LamentXU123 LamentXU123 commented Apr 21, 2026

Currently string in putenv and getenv can be truncated by NUL:

<?php
var_dump(putenv("PHP_PUTENV_NUL_TEST=va\0ue"));
echo getenv('PHP_PUTENV_NUL_TEST');
echo getenv("PHP_PUTENV_NUL_TEST\0asd");

output:

bool(true)
vava

Reproduce in https://3v4l.org/ngSWJ
According to the newest policy these cases are supposed to resulted in a ValueError.

@LamentXU123 LamentXU123 changed the title Throw a ValueError when the parameter includes NUL bytes in putenv Throw a ValueError when the parameter includes NUL bytes in putenv and getenv Apr 21, 2026
Comment thread ext/standard/basic_functions.c Outdated
Comment thread NEWS
argument value is passed. (Girgias)
. linkinfo() now raises a ValueError when the argument is an empty string.
(Weilin Du)
. getenv() now raises a ValueError when the $name argument contains null
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I think getenv()/putenv() entries can be crammed into one wdyt ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants