...
This noncompliant code example copies the string returned by getenv() into a fixed-size buffer.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
void f() {
char path[PATH_MAX]; /* requires PATH_MAX to be defined */
strcpy(path, getenv("PATH"));
/* Use path */
}
|
...
In the following compliant solution, the strlen() function is used to calculate the size of the string, and the required space is dynamically allocated.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
void f() {
char *path = NULL;
/* Avoid assuming $PATH is defined or has limited length */
const char *temp = getenv("PATH");
if (temp != NULL) {
path = (char*) malloc(strlen(temp) + 1);
if (path == NULL) {
/* Handle error condition */
} else {
strcpy(path, temp);
}
/* Use path */
}
}
|
...
Tool | Version | Checker | Description |
|---|---|---|---|
Compass/ROSE |
|
| Can detect violations of the rule by using the same method as STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator. |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...