This is the minimal fix for __putenv leaving a pointer to freed heap storage in __env_map array, which could later on lead to errors such as double-free.
@@ -30,6 +30,7 @@ int __putenv(char *s, int a)
}
} else {
free(__env_map[j]);
+ __env_map[j] = s;