From 6ce1dfb0d1e2be137d3f23ab1ac6f4aad9f182d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stefan=20B=C3=BChler?= <stbuehler@web.de>
Date: Thu, 31 Jul 2008 20:45:36 +0000
Subject: [PATCH] mod_{fast,s}cgi: overwrite environment variables (#1722)

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2265 152afb58-edef-0310-8abb-c4023f1b3aa9
---
 NEWS              |  1 +
 src/mod_fastcgi.c | 10 ++++++++++
 src/mod_scgi.c    | 10 ++++++++++
 3 files changed, 21 insertions(+)

diff --git a/NEWS b/NEWS
index 077a83d3..db3189f2 100644
--- a/NEWS
+++ b/NEWS
@@ -43,6 +43,7 @@ NEWS
   * Use filedescriptor 0 for mod_scgi spawn socket, redirect STDERR to /dev/null (#1716)
   * fixed round-robin balancing in mod_proxy (#1715)
   * fixed EINTR handling for waitpid in mod_fastcgi
+  * mod_{fast,s}cgi: overwrite environment variables (#1722)
 
 - 1.4.19 - 2008-03-10
 
diff --git a/src/mod_fastcgi.c b/src/mod_fastcgi.c
index edc18fa8..22940c09 100644
--- a/src/mod_fastcgi.c
+++ b/src/mod_fastcgi.c
@@ -703,6 +703,7 @@ FREE_FUNC(mod_fastcgi_free) {
 
 static int env_add(char_array *env, const char *key, size_t key_len, const char *val, size_t val_len) {
 	char *dst;
+	size_t i;
 
 	if (!key || !val) return -1;
 
@@ -712,6 +713,15 @@ static int env_add(char_array *env, const char *key, size_t key_len, const char
 	/* add the \0 from the value */
 	memcpy(dst + key_len + 1, val, val_len + 1);
 
+	for (i = 0; i < env->used; i++) {
+		if (0 == strncmp(dst, env->ptr[i], key_len + 1)) {
+			/* don't care about free as we are in a forked child which is going to exec(...) */
+			/* free(env->ptr[i]); */
+			env->ptr[i] = dst;
+			return 0;
+		}
+	}
+
 	if (env->size == 0) {
 		env->size = 16;
 		env->ptr = malloc(env->size * sizeof(*env->ptr));
diff --git a/src/mod_scgi.c b/src/mod_scgi.c
index 01d1f159..e6f17541 100644
--- a/src/mod_scgi.c
+++ b/src/mod_scgi.c
@@ -593,6 +593,7 @@ FREE_FUNC(mod_scgi_free) {
 
 static int env_add(char_array *env, const char *key, size_t key_len, const char *val, size_t val_len) {
 	char *dst;
+	size_t i;
 
 	if (!key || !val) return -1;
 
@@ -602,6 +603,15 @@ static int env_add(char_array *env, const char *key, size_t key_len, const char
 	/* add the \0 from the value */
 	memcpy(dst + key_len + 1, val, val_len + 1);
 
+	for (i = 0; i < env->used; i++) {
+		if (0 == strncmp(dst, env->ptr[i], key_len + 1)) {
+			/* don't care about free as we are in a forked child which is going to exec(...) */
+			/* free(env->ptr[i]); */
+			env->ptr[i] = dst;
+			return 0;
+		}
+	}
+
 	if (env->size == 0) {
 		env->size = 16;
 		env->ptr = malloc(env->size * sizeof(*env->ptr));