Only use environment variables if uid and gid are the same as euid and egid.

This is part of a large change submitted by Markus Friedl <markus@openbsd.org>

diff --git a/crypto/threads/mttest.c b/crypto/threads/mttest.c
index d0e088218b0ab59522bd08e14bf3876a0e2f5f71..f6f3df4b6aa89c79cabeb9eaa80c51e6f263a64f 100644 (file)
--- a/crypto/threads/mttest.c
+++ b/crypto/threads/mttest.c
@@ -267,7 +267,8 @@ bad:
                goto end;
                }
 
-       if (cipher == NULL) cipher=getenv("SSL_CIPHER");
+       if (cipher == NULL && OPENSSL_issetugid() == 0)
+               cipher=getenv("SSL_CIPHER");
 
        SSL_load_error_strings();
        OpenSSL_add_ssl_algorithms();