CVS: cvs.openbsd.org: src

CVSROOT:	/cvs
Module name:	src
Changes by:	[email protected]	2026/08/16 06:02:47

Modified files:
	usr.bin/mandoc : manpath.c 

Log message:
Stop clobbering the return value of getenv(3) with strtok(3).
The getenv(3) manual discourages tampering with the returned string.
Instead, copy the value to the heap such that it can be safely modified.

This fixes a bug that Luca Del Re <[email protected]>
found on Alpine Linux and reported to bsd.lv.

The consequence of the bug was likely implementation-dependent, but
on both OpenBSD and Alpine Linux, the first colon after the first
byte of the MANPATH variable was set to NUL in the actual environment
of the man(1) process, and this truncated value would later be
passed to the pager child process by execv(3).  Hence, while
MANPATH=:mypath1 worked as expected, the pager would only see
MANPATH=mypath1 if man(1) saw any of the following:
MANPATH=mypath1:
MANPATH=mypath1:mypath2
MANPATH=mypath1::mypath2