The getenv() function searches an environment list , provided by the host environment, for a string that matches a specified name. The getenv() function , and returns a pointer to a string associated with the matched list member. Due to the way environment variables are stored, multiple environment variables with the same name can cause unexpected results.
...
Depending on the implementation, a program may not consistently choose the same value if there are multiple environment variables with the same name. The GNU glibc library attempts to deal with this issue in getenv() and setenv() by always using the first variable it comes across, and ignoring the rest. unsetenv() will remove all the entries matching the variable name. Other implementations are following this lead.
Non-Compliant Coding Example
Do not search or modify environ directly. Using a stable function such as getenv() or setenv() will prevent this issue.
...
use different methods to get environment variables, as you may end up checking one value, but actually returning another.
Compliant Solution
The glibc getenv() and setenv() functions will always choose the same value, so using them is a good option.
| Code Block | ||
|---|---|---|
| ||
char *temp;
char *copy;
if ((temp = getenv("TEST_ENV")) != NULL) {
copy= malloc(strlen(temp) + 1);
if (copy != NULL)
strcpy(copy, temp);
else
/* handle error condition */
copy[0] = 'a';
setenv("TEST_ENV", copy, 1);
}
else {
return -1;
}
In addition, you could search through {{environ}} to see if there are multiple entries for a variable. Upon finding something, simply {{abort()}}. It is very unlikely that there would be a need for more than one variable of the same name.
|
Risk Assessment
An adversary could create several environment variables with the same name. If the program checks against one copy, but actually uses another, this could be a clear problem.
...