Do not cache the results of getenv() in the temporary filename generation

logic as that might result in a UAF if an environment variable value is
modified using setenv() or similar.

FossilOrigin-Name: cefd5807d8be41f8ff0ce1ce487064dcbcf2f05583b86dbe68a3ae1960b13d9f

manifest

@@ -1,5 +1,5 @@
-C Remove\san\sunnecessary\smunmap()\sfrom\sthe\sunix\sinterface.
-D 2026-07-21T23:54:01.789
+C Do\snot\scache\sthe\sresults\sof\sgetenv()\sin\sthe\stemporary\sfilename\sgeneration\nlogic\sas\sthat\smight\sresult\sin\sa\sUAF\sif\san\senvironment\svariable\svalue\sis\nmodified\susing\ssetenv()\sor\ssimilar.
+D 2026-07-22T12:55:23.697
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -727,7 +727,7 @@ F src/os.h 1ff5ae51d339d0e30d8a9d814f4b8f8e448169304d83a7ed9db66a65732f3e63
 F src/os_common.h 6c0eb8dd40ef3e12fe585a13e709710267a258e2c8dd1c40b1948a1d14582e06
 F src/os_kv.c 713336d0c646720a9ccbd5bc6fe217bb4924dd28adea25d83a2af5346cb030e6
 F src/os_setup.h 8efc64eda6a6c2f221387eefc2e7e45fd5a3d5c8337a7a83519ba4fbd2957ae2
-F src/os_unix.c 35a8fa7a11c335da484fe887efa23447fef01b63b6bbc032ec3610f94c2db024
+F src/os_unix.c 5ccac2954679efc003330a5686cd2048ec9059f90f54f43900e60877e9158aa7
 F src/os_win.c 1227a3e962b017d676d985a8aec0d64f273991931ea0a0b99773651102f62df4
 F src/os_win.h c06ccc3a090cf54202ea58981c298817f3309d4c9e4d52ad0a02927346493721
 F src/pager.c 678ee3b68638ee427cc1b071b11181d0f2a827f6cb4d6ec7c12d5fa5f6a752d0
@@ -2217,8 +2217,9 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 014ef252c7ea404340a5af52a6615cdddd969a4dbf30712fda538550240bb9fc
-R db35009292f15ec72dcee511d1de692d
+P 5fc1ede8b2e559db8a5d783d1065b1f1b2eef73054486552b700706208cbdfd1 82e522ff1429e7eed2ffb0e960badc5757fd015023b7c0679ba32108e44e4abd
+R 46939929c46affb76858b635fea36ba9
+T +closed 82e522ff1429e7eed2ffb0e960badc5757fd015023b7c0679ba32108e44e4abd
 U drh
-Z 5b418561771d835342ccd84f22544807
+Z bdf1a4651337684379b93c8dd7823792
 # Remove this line to create a well-formed Fossil manifest.

manifest.uuid

@@ -1 +1 @@
-5fc1ede8b2e559db8a5d783d1065b1f1b2eef73054486552b700706208cbdfd1
+cefd5807d8be41f8ff0ce1ce487064dcbcf2f05583b86dbe68a3ae1960b13d9f

src/os_unix.c

@@ -6246,36 +6246,29 @@ static int fillInUnixFile(
   return rc;
 }
 
-/*
-** Directories to consider for temp files.
-*/
-static const char *azTempDirs[] = {
-  0,
-  0,
-  "/var/tmp",
-  "/usr/tmp",
-  "/tmp",
-  "."
-};
-
-/*
-** Initialize first two members of azTempDirs[] array.
-*/
-static void unixTempFileInit(void){
-  azTempDirs[0] = getenv("SQLITE_TMPDIR");
-  azTempDirs[1] = getenv("TMPDIR");
-}
-
 /*
 ** Return the name of a directory in which to put temporary files.
 ** If no suitable temporary file directory can be found, return NULL.
+**
+** The return value might be a string obtained from getenv() and so
+** the return value should not be used after any call to setenv() or
+** putenv() as that value might have been freed.
 */
 static const char *unixTempFileDir(void){
-  unsigned int i = 0;
+  unsigned int i;
   struct stat buf;
-  const char *zDir = sqlite3_temp_directory;
+  const char *zDir;
 
-  while(1){
+  for(i=0; i<7; i++){
+    switch( i ){
+      case 0:  zDir = sqlite3_temp_directory;   break;
+      case 1:  zDir = getenv("SQLITE_TMPDIR");  break;
+      case 2:  zDir = getenv("TMPDIR");         break;
+      case 3:  zDir = "/var/tmp";               break;
+      case 4:  zDir = "/usr/tmp";               break;
+      case 5:  zDir = "/tmp";                   break;
+      default: zDir = ".";                      break;
+    }
     if( zDir!=0
 #if OS_VXWORKS
      && zDir[0]=='/'
@@ -6286,8 +6279,6 @@ static const char *unixTempFileDir(void){
     ){
       return zDir;
     }
-    if( i>=sizeof(azTempDirs)/sizeof(azTempDirs[0]) ) break;
-    zDir = azTempDirs[i++];
   }
   return 0;
 }
@@ -8570,9 +8561,6 @@ int sqlite3_os_init(void){
   assert( UNIX_SHM_DMS==128   );  /* Byte offset of the deadman-switch */
 #endif
 
-  /* Initialize temp file dir array. */
-  unixTempFileInit();
-
   return SQLITE_OK;
 }