--- Libc/Libc-1725.40.4/sys/posix_spawn.c
+++ Libc/Libc-1669.40.2/sys/posix_spawn.c
@@ -73,55 +73,48 @@
 		char *const argv[ __restrict], char *const envp[ __restrict])
 {
 	const char *env_path;
-	char path_buf[PATH_MAX];
-	char *bp, *np, *op, *p;
+	char *bp;
+	char *cur;
+	char *p;
 	char **memp;
-	size_t ln, lp;
+	int lp;
+	int ln;
 	int cnt;
 	int err = 0;
 	int eacces = 0;
 	struct stat sb;
+	char path_buf[PATH_MAX];
+
+	if ((env_path = getenv("PATH")) == NULL)
+		env_path = _PATH_DEFPATH;
 
 	/* If it's an absolute or relative path name, it's easy. */
 	if (strchr(file, '/')) {
 		bp = (char *)file;
-		env_path = op = NULL;
+		cur = NULL;
 		goto retry;
 	}
-
-	if ((env_path = getenv("PATH")) == NULL)
-		env_path = _PATH_DEFPATH;
-
 	bp = path_buf;
 
 	/* If it's an empty path name, fail in the usual POSIX way. */
 	if (*file == '\0')
 		return (ENOENT);
 
-	op = env_path;
-	ln = strlen(file);
-	while (op != NULL) {
-		np = strchrnul(op, ':');
-
+	if ((cur = alloca(strlen(env_path) + 1)) == NULL)
+		return ENOMEM;
+	strcpy(cur, env_path);
+	while ((p = strsep(&cur, ":")) != NULL) {
 		/*
 		 * It's a SHELL path -- double, leading and trailing colons
 		 * mean the current directory.
 		 */
-		if (np == op) {
-			/* Empty component. */
+		if (*p == '\0') {
 			p = ".";
 			lp = 1;
 		} else {
-			/* Non-empty component. */
-			p = op;
-			lp = np - op;
+			lp = strlen(p);
 		}
-
-		/* Advance to the next component or terminate after this. */
-		if (*np == '\0')
-			op = NULL;
-		else
-			op = np + 1;
+		ln = strlen(file);
 
 		/*
 		 * If the path is too long complain.  This is a possible
@@ -194,13 +187,7 @@
 	}
 	if (eacces)
 		err = EACCES;
-	/*
-	 * Preserve errno from posix_spawn(3) if it wasn't a PATH search, or
-	 * if it was a PATH search and we bailed out early.  Note that every
-	 * branch in the loop jumps to the `done` label to preserve errno, so
-	 * this is more of a defensive check.
-	 */
-	else if (env_path != NULL && op == NULL)
+	else
 		err = ENOENT;
 done:
 	return (err);