Description: Disallow invalid characters in environment variable names
 This prevents bypassing AcceptEnv wildcard restrictions (CVE-2014-2532).
Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=8569eba5d7f7348ce3955eeeb399f66f25c52ece
Forwarded: not-needed
Last-Update: 2014-04-02

Index: b/session.c
===================================================================
--- a/session.c
+++ b/session.c
@@ -952,6 +952,11 @@
 	u_int envsize;
 	u_int i, namelen;
 
+	if (strchr(name, '=') != NULL) {
+		error("Invalid environment variable \"%.100s\"", name);
+		return;
+	}
+
 	/*
 	 * If we're passed an uninitialized list, allocate a single null
 	 * entry before continuing.
@@ -2177,8 +2182,8 @@
 	char *name, *val;
 	u_int name_len, val_len, i;
 
-	name = packet_get_string(&name_len);
-	val = packet_get_string(&val_len);
+	name = packet_get_cstring(&name_len);
+	val = packet_get_cstring(&val_len);
 	packet_check_eom();
 
 	/* Don't set too many environment variables */
