Page History

...

Therefore, altering the string returned by setlocale() or the structure returned by localeconv() might cause undefined behavior.

Noncompliant Code Example

This noncompliant code example modifies the string returned by getenv() by replacing all double quote (") characters with underscores.

void strtr(char *str, char orig, char rep) {
  while (*str != '\0') {
    if (*str == orig) {
      *str = rep;
    }
    str++;
  }
}

/* ... */

char *env = getenv("TEST_ENV");
if (env == NULL) {
  /* Handle error */
}

strtr(env,'"', '_');


/* ... */

Compliant Solution (local copy)

For the case where the intent of the noncompliant code example is to use the modified value of the environment variable locally and not modify the environment, this compliant solution makes a local copy of that string value and then modifies the local copy.

const char *env;
char *copy_of_env;

env = getenv("TEST_ENV");
if (env == NULL) {
  /* Handle error */
}

copy_of_env = (char *)malloc(strlen(env) + 1);
if (copy_of_env == NULL) {
  /* Handle error */
}

strcpy(copy_of_env, env);
strtr(copy_of_env,'\"', '_');

Compliant Solution (Modifying the Environment in POSIX)

For the case where the intent is to modify the environment, this compliant solution saves the altered string back into the environment by using the POSIX setenv() and strdup() functions.

const char *env;
char *copy_of_env;

env = getenv("TEST_ENV");
if (env == NULL) {
  /* Handle error */
}

copy_of_env = strdup(env);
if (copy_of_env == NULL) {
  /* Handle error */
}

strtr(copy_of_env,'\"', '_');

if (setenv("TEST_ENV", copy_of_env, 1) != 0) {
  /* Handle error */
}

Noncompliant Code Example

This noncompliant code example modifies the string returned by setlocale() by terminating the string when '.' is encountered such as “en_US.iso88591” to “en_US”. In this case, the behavior is undefined.

void terminate_on_dot(char *str){
  int i;

  for (i = 0; i < strlen(locale); i++){
    if(locale[i] == ‘.’){
      locale[i] = ‘\0’;
      break;
    }
  }
}

/* ... */

char *locale = setlocale(LC_ALL, "");
if (locale == NULL) {
  /* Handle error */
}

terminate_on_dot(locale);

/* ... */

Compliant Solution

Similar to the case of getenv(), this compliant solution makes a local copy of that string value and then modifies the local copy.

const char *locale;
char *copy_of_locale;

locale = setlocale(LC_ALL, "");
if (locale == NULL) {
  /* Handle error */
}

copy_of_locale = (char *)malloc(strlen(locale) + 1);
if (copy_of_locale == NULL) {
  /* Handle error */
}

strcpy(copy_of_locale, locale);
terminate_on_dot(copy_of_locale);

/* ... */

Risk Assessment

The modified object may be overwritten by a subsequent call to the getenv(), setlocale(), or localeconv() functions. Depending on the implementation, modifying the object pointed to by the return value of these functions may or may not modify the environment.

Automated Detection

Compass/ROSE can detect violations of this rule. In particular, it ensures that the result of getenv() is stored into a const variable.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C++ Secure Coding Standard as ENV30-CPP. Do not modify the string returned by getenv().

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.20.4.5, "The {{getenv}} function", Section 7.11.1.1, “The {{setlocale}} function”, Section 7.11.2.1, “The {{localeconv}} function”
\[[Open Group 04|AA. C References#Open Group 04]\] [getenv|http://www.opengroup.org/onlinepubs/000095399/functions/getenv.html], [setlocale|http://www.opengroup.org/onlinepubs/009695399/functions/setlocale.html], [localeconv|http://www.opengroup.org/onlinepubs/009695399/functions/localeconv.html]

...