)]}'
{
  "commit": "c131ae56c13ffe6bd7089cf0d9bd00a7c2dbc71f",
  "tree": "c1c8d6b3def34fd3d8cd94823fcd2752d005b7b9",
  "parents": [
    "405c32d2b18a683ba36301351af75125d9afda08"
  ],
  "author": {
    "name": "Denis V. Lunev",
    "email": "den@openvz.org",
    "time": "Wed May 20 23:26:27 2026 +0200"
  },
  "committer": {
    "name": "Stefan Hajnoczi",
    "email": "stefanha@redhat.com",
    "time": "Wed Jun 03 12:45:06 2026 -0400"
  },
  "message": "util/envlist: fix prefix-match in envlist_unsetenv() name lookup\n\nenvlist_unsetenv() looked up the entry to remove with\nstrncmp(entry-\u003eev_var, env, strlen(env)). The comparison length is\nthe requested name\u0027s length, so any stored entry whose name *starts*\nwith that name compares equal. envlist_setenv() inserts at the head\nof the list, so the first hit wins: with FOO\u003d... stored first and\nFOOBAR\u003d... stored afterward, envlist_unsetenv(\"FOO\") iterates from\nthe head, matches FOOBAR\u003d... on the prefix, and drops it instead of\nFOO\u003d...\n\nlinux-user and bsd-user reach this code via the -U command-line\nswitch, so the bug is reachable from a normal qemu-user invocation.\n\nenvlist_setenv() used the same strncmp pattern but with\nenvname_len \u003d (eq_sign - env + 1), so the \u0027\u003d\u0027 byte sat inside the\ncompared window and acted as an implicit boundary. setenv was\ntherefore not buggy -- but the safety lived in the byte layout of\nev_var rather than in the entry, so a future edit could easily\ndrift the two sites apart again.\n\nStore the name length on each entry at insertion time and compare\nwith explicit length equality plus memcmp via a small helper. Use\nthe helper at both lookup sites so the boundary becomes a\nstructural property of the entry: envlist_unsetenv() stops\nprefix-matching, and envlist_setenv()\u0027s self-search no longer\ndepends on the \u0027\u003d\u0027 byte serving as a sentinel.\n\nFixes: 04a6dfebb6b5 (\"linux-user: Add generic env variable handling\")\nSigned-off-by: Denis V. Lunev \u003cden@openvz.org\u003e\nReviewed-by: Stefan Hajnoczi \u003cstefanha@redhat.com\u003e\nMessage-id: 20260520212628.479772-2-den@openvz.org\nCc: Stefan Hajnoczi \u003cstefanha@redhat.com\u003e\nCc: Markus Armbruster \u003carmbru@redhat.com\u003e\nCc: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nSigned-off-by: Stefan Hajnoczi \u003cstefanha@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "15fdbb109d66273d7b98151f86648654598faa94",
      "old_mode": 33188,
      "old_path": "util/envlist.c",
      "new_id": "196c92c190c2c06e82f0c725b713b9e14e5c3f7a",
      "new_mode": 33188,
      "new_path": "util/envlist.c"
    }
  ]
}