> Index: putenv.c
> ===================================================================
> RCS file: /cvsroot/src/lib/libc/stdlib/putenv.c,v
> retrieving revision 1.11
<snip>
> +	if (__findenv(str, &offset) == NULL) {
> +		if ((offset = __newenv()) < 0) {
> +			return (-1);
> +		}

You need to hold __environ_lock across this call.

> Index: setenv.c
> ===================================================================
> RCS file: /cvsroot/src/lib/libc/stdlib/setenv.c,v
> retrieving revision 1.21
> diff -u -r1.21 setenv.c
<snip>
> +	environ = p;
> +	environ[cnt + 1] = NULL;

These two would be safer the other way around (just in case someone
is reading environ without the lock held.

AT line 95 the code has:

	if (strlen(c) >= l_value) {     /* old larger; copy over */
		while ((*c++ = *value++) != '\0');
		rwlock_unlock(&__environ_lock);
		return (0);
	} 

This isn't safe anymore....

I'm also not 100% about how the code behaves in the presence of
environment string that don't contain an '=' (eg after putenv("fred");).

It needs to do something sensible.

	David

-- 
David Laight: david@l8s.co.uk