From a735b65b70a7df1d78870e9dd308652567eae437 Mon Sep 17 00:00:00 2001
From: "Roland C. Dowdeswell" <elric@imrryr.org>
Date: Wed, 27 May 2026 17:20:23 +0100
Subject: [PATCH] gssapi: avoid putenv use-after-free in store_cred

Fixes #1163
---
 lib/gssapi/krb5/store_cred.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/lib/gssapi/krb5/store_cred.c b/lib/gssapi/krb5/store_cred.c
index a4f5e87ef..bb7fae994 100644
--- a/lib/gssapi/krb5/store_cred.c
+++ b/lib/gssapi/krb5/store_cred.c
@@ -83,8 +83,25 @@ set_proc(OM_uint32 *minor, gss_buffer_set_t env)
 #ifndef WIN32
     size_t i;
 
-    for (i = 0; i < env->count; i++)
-        putenv(env->elements[i].value);
+    for (i = 0; i < env->count; i++) {
+        char *var = (char *)env->elements[i].value;
+        char *eq  = strchr(var, '=');
+        char *val;
+        int e;
+
+        if (eq == NULL) {
+            *minor = EINVAL;
+            return GSS_S_FAILURE;
+        }
+        val = eq + 1;
+        *eq = '\0';
+        e = setenv(var, val, 1);
+        *eq = '=';
+        if (e != 0) {
+            *minor = errno ? errno : EINVAL;
+            return GSS_S_FAILURE;
+        }
+    }
 #endif
     return GSS_S_COMPLETE;
 }