Page History

Some functions return a pointer to an object that cannot be modified without causing undefined behavior. These functions include the standard getenv(), setlocale(), localeconv(), and strerror() functions.

C11, Section 7.22.4.6 6 of the C standard [ISO/IEC 9899:2011] , defines getenv as follows:

The getenv function returns a pointer to a string associated with the matched list member. The string pointed to shall not be modified by the program, but may be overwritten by a subsequent call to the getenv function. If the specified name cannot be found, a null pointer is returned.

Consequently, if the string returned by getenv() must be altered, a local copy should be created. Altering the string returned by getenv() results in undefined behavior. See also undefined behavior 184 of Annex J of C11.

Similarly, C11, Section 7.11.1.1 [ISO/IEC 9899:2011] , defines setlocale and localeconv as follows:

...

Altering the string returned by setlocale() or the structure returned by localeconv() results in undefined behavior. See also undefined behaviors 120 and 121 of Annex J. Furthermore, the C standard imposes no requirements on the contents of the string by setlocale(). Consequently, a program should make no assumptions as to the string's internal contents or structure.

Finally, C11, Section 7.24.6.2 [ISO/IEC 9899:2011], states:

The strerror function returns a pointer to the string, the contents of which are locale specific. The array pointed to shall not be modified by the program, but may be overwritten by a subsequent call to the strerror function.

...

Compliant Solution (getenv()) (Local Copy)

For the case where the If the intent of the noncompliant code example is to use the modified value of the environment variable locally and not modify the environment, this compliant solution makes a local copy of that string value and then modifies it.

...

Compliant Solution (getenv()) (Modifying the Environment in POSIX)

For the case where the If the intent is to modify the environment, this compliant solution saves the altered string back into the environment by using the POSIX setenv() and strdup() functions.

...

CERT C++ Secure Coding Standard: ENV30-CPP. Do not modify the string returned by getenv()

ISO/IEC 9899:2011 Section  Section 7.11.1.1, "€œThe setlocale function,"€ Section 7.11.2.1, "€œThe localeconv function," Section 7.22.4.6, "The getenv function," and Section 7.24.6.2, "The strerror function"

...