Theo de Raadt has added a change that bans the use of null characters in shell scripts processed by the default command interpreter ksh. The presence of null characters in scripts will now cause execution to terminate with an error message, except when they are placed within data attached at the end of the file following the code. This change is included in the OpenBSD-Current branch, which will form the basis for the OpenBSD 7.6 release.
It is noted that such a change will eliminate the ambiguity in behavior related to handling null characters in C code that uses strings where the null byte is employed to indicate the end of the string. The study of null character handling in various shells showed that each had one or more cases where the null byte in input data or variable content led to behavior different from other shells; for example, some shells ignored it, some replaced it with a space, while others terminated further parsing of the script or stopped its execution.
Source: opennet.ru
