Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

This non-compliant code example showing that modification of the string value returned by the function getenv(). Characters in env should not be changed directly.

Code Block
bgColor#FFcccc
int foo()
{
    char *env;
    env = getenv("TEST_ENV");
    env[0] = 'a';

    /*Do some more things*/

    return 0;
}

...

This is a compliant code solution. If it is necessary to modify the value of the string returned by the function getenv(), then the programmer should make a local copy of that string value, and then modify the local copy of that string. If it is necessary to propagate the changes back to the environment, use setenv().

Code Block
bgColor#ccccFF
int foo()
{
    char *env;
    char *copy_of_env;

    env = getenv("TEST_ENV");
    copy_of_env = malloc( strlen(env) + 1 );
    /* Error handling */
    strcpy(copy_of_env, env);

    copy_of_env[0] = 'a';

    /*Do some more things*/

    return 0;
}

...

Rule

Severity 

Likelihood 

Remediation Cost

Priority

Level

ENV30-C

2 (Medium)

3 (probable)

2 (Medium)

P12

L1

References

Wiki Markup
\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.20.4.5, "The {{getenv}} function"
\[[Open Group 04|AA. C References#Open Group 04]\] [getenv|http://www.opengroup.org/onlinepubs/000095399/functions/getenv.html]