Page History

Do not make any assumptions about the size of environment variables, as because an adversary might have full control over the environment. If the environment variable needs to be stored, then the length of the associated string should be calculated, and the storage dynamically allocated (see STR31-C. Guarantee that storage for strings has sufficient space for character data and the NULL terminator).

...

This noncompliant code example copies the string returned by getenv() into a fixed-size buffer.

char copy[16];
const char *temp = getenv("TEST_ENV");
if (temp != NULL) {
  strcpy(copy, temp);
}

...

char *copy = NULL;
const char *temp = getenv("TEST_ENV");
if (temp != NULL) {
  copy = (char *)malloc(strlen(temp) + 1);
  if (copy != NULL) {
    strcpy(copy, temp);
  }
  else {
    /* handleHandle error condition */
  }
}

Risk Assessment

...