Prevent mutating the global environment pointer in CommandExt::exec and opt to use execve and resolve path manually

library/std/src/sys/pal/unix/conf.rs

@@ -6,20 +6,18 @@ pub fn page_size() -> usize {
     unsafe { libc::sysconf(libc::_SC_PAGESIZE) as usize }
 }
 
-/// Returns the value for [`confstr(key, ...)`][posix_confstr]. Currently only
-/// used on Darwin, but should work on any unix (in case we need to get
-/// `_CS_PATH` or `_CS_V[67]_ENV` in the future).
+/// Returns the value for [`confstr(key, ...)`][posix_confstr].
 ///
 /// [posix_confstr]:
 ///     https://pubs.opengroup.org/onlinepubs/9799919799/functions/confstr.html
-#[cfg(target_vendor = "apple")]
+#[cfg(any(target_vendor = "apple", all(target_os = "linux", target_env = "gnu")))]
 pub fn confstr(
     key: crate::ffi::c_int,
     size_hint: Option<usize>,
-) -> crate::io::Result<crate::ffi::OsString> {
-    use crate::ffi::OsString;
+) -> crate::io::Result<crate::ffi::CString> {
+    use alloc_crate::ffi::CString;
+
     use crate::io;
-    use crate::os::unix::ffi::OsStringExt;
 
     let mut buf: Vec<u8> = Vec::with_capacity(0);
     let mut bytes_needed_including_nul = size_hint
@@ -61,11 +59,17 @@ pub fn confstr(
     unsafe {
         buf.set_len(bytes_needed_including_nul);
         // Remove the NUL-terminator.
-        let last_byte = buf.pop();
+        let last_byte = buf.last();
         // ... and smoke-check that it *was* a NUL-terminator.
-        assert_eq!(last_byte, Some(0), "`confstr` provided a string which wasn't nul-terminated");
+        assert_eq!(
+            last_byte.copied(),
+            Some(0),
+            "`confstr` provided a string which wasn't nul-terminated"
+        );
     };
-    Ok(OsString::from_vec(buf))
+    // SAFETY: From above, we have confirmed that the buffer
+    // contains a nul terminating byte.
+    Ok(unsafe { CString::from_vec_with_nul_unchecked(buf) })
 }
 
 #[cfg(all(target_os = "linux", target_env = "gnu"))]

library/std/src/sys/pal/unix/conf/tests.rs

@@ -31,7 +31,7 @@ fn test_confstr() {
         let value_nohint = super::confstr(key, None).unwrap_or_else(|e| {
             panic!("confstr({key}, None) failed: {e:?}");
         });
-        let end = (value_nohint.len() + 1) * 2;
+        let end = (value_nohint.count_bytes() + 1) * 2;
         for hint in 0..end {
             assert_eq!(
                 super::confstr(key, Some(hint)).as_deref().ok(),

library/std/src/sys/paths/unix.rs

@@ -430,13 +430,13 @@ pub fn current_exe() -> io::Result<PathBuf> {
 
 #[cfg(target_vendor = "apple")]
 fn darwin_temp_dir() -> PathBuf {
-    crate::sys::pal::conf::confstr(libc::_CS_DARWIN_USER_TEMP_DIR, Some(64))
-        .map(PathBuf::from)
-        .unwrap_or_else(|_| {
-            // It failed for whatever reason (there are several possible reasons),
-            // so return the global one.
-            PathBuf::from("/tmp")
-        })
+    let darwin_temp_dir = crate::sys::pal::conf::confstr(libc::_CS_DARWIN_USER_TEMP_DIR, Some(64));
+    match darwin_temp_dir {
+        Ok(temp_dir) => OsString::from_vec(temp_dir.into_bytes()).into(),
+        // It failed for whatever reason (there are several possible reasons),
+        // so return the global one.
+        Err(_) => PathBuf::from("/tmp"),
+    }
 }
 
 pub fn temp_dir() -> PathBuf {

library/std/src/sys/process/unix/common.rs

@@ -83,6 +83,33 @@ cfg_select! {
     }
 }
 
+/// Retrieves the fallback path *specifically* used by each platform's `execvp`
+/// implementation.
+fn get_default_path() -> CString {
+    #[cfg(all(target_os = "linux", target_env = "gnu"))]
+    use crate::sys::conf::confstr;
+    cfg_select! {
+        all(target_os = "linux", target_env = "gnu") => {
+            confstr(libc::_CS_PATH, None).unwrap_or(CString::default())
+        }
+        any(
+            all(target_os = "linux", not(target_env = "gnu")),
+            target_vendor = "apple",
+            target_os = "android",
+            target_os = "openbsd",
+            target_os = "freebsd",
+            target_os = "dragonfly",
+        ) => {
+            // SAFETY: libc::_PATH_DEFPATH is a nul-terminated char pointer
+            unsafe { CString::from(CStr::from_ptr(libc::_PATH_DEFPATH)) }
+        }
+        target_os = "aix" => {
+            CString::new(":/bin:/usr/bin").expect("the provided string should not have a nul byte")
+        }
+        _ => CString::default(),
+    }
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // Command
 ////////////////////////////////////////////////////////////////////////////////
@@ -91,6 +118,7 @@ pub struct Command {
     program: CString,
     args: CStringArray,
     env: CommandEnv,
+    default_path: CString,
 
     program_kind: ProgramKind,
     cwd: Option<CString>,
@@ -168,10 +196,12 @@ impl Command {
         let program = os2c(program, &mut saw_nul);
         let mut args = CStringArray::with_capacity(1);
         args.push(program.clone());
+
         Command {
             program,
             args,
             env: Default::default(),
+            default_path: get_default_path(),
             program_kind,
             cwd: None,
             chroot: None,
@@ -271,6 +301,10 @@ impl Command {
         self.env.does_clear()
     }
 
+    pub fn get_default_path(&self) -> &CStr {
+        &self.default_path
+    }
+
     pub fn get_resolved_envs(&self) -> CommandResolvedEnvs {
         CommandResolvedEnvs::new(self.env.capture())
     }

library/std/src/sys/process/unix/common/cstring_array.rs

@@ -32,6 +32,11 @@ impl CStringArray {
         drop(unsafe { CString::from_raw(old.cast_mut()) });
     }
 
+    /// Returns the length of the array (null pointer excluded).
+    pub fn len(&self) -> usize {
+        self.ptrs.len() - 1
+    }
+
     /// Push an additional string to the array.
     pub fn push(&mut self, item: CString) {
         let argc = self.ptrs.len() - 1;