Setting process env vars with interior nuls leads to unexpected env for child

[kamalmarhubi]

Noticed by @talchas when discussing #30858.

The environment variables are never checked for interior nuls. This leads to very unexpected results in the child's env. Keys with interior nuls are truncated and have no values, and values are truncated at the nul:

use std::process::Command;

fn main() {
    Command::new("/usr/bin/env").env("a\0b", "c\0d")
                                .env("ab", "c\0d")
                                .status()
                                .unwrap();
}

(playground)

Output:

a
ab=c
USER=rust
HOME=/home/rust
PATH=/usr/local/bin:/usr/bin:/bin
LOGNAME=rust
PWD=/home/rust

[kamalmarhubi]

As with #30858, it's probably best to validate when spawning the child, so that the error can be returned in a Result.

[nagisa]

The underlying issue in both cases is that OsString allows interior nulls, while neither POSIX-y nor Windows systems support that use-case at all.

EDIT: apparently that’s intended, so we’re just skimping on conversion to CString in some places.

cc @alexcrichton

[kamalmarhubi]

Yeah, conversion to CString at spawn would be the right thing to do.

[kamalmarhubi]

I have a patch in the works for this.