The getenv() function searches an environment list for a string that matches a specified name , and returns a pointer to a string associated with the matched list member.
| Wiki Markup |
|---|
Section 7.20.4.5 of C99 states: that \[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] |
...
| Code Block | ||
|---|---|---|
| ||
extern char **environ;
int main(void) {
if (multiple_vars_with_same_name()) {
printf("Someone may be tampering.\n");
return 1;
}
/* ... */
return 0;
}
int multiple_vars_with_same_name(void) {
size_t i;
size_t j;
size_t k;
size_t l;
size_t len_i;
size_t len_j;
for(size_t i = 0; environ[i] != NULL; i++) {
for(size_t j = i; environ[j] != NULL; j++) {
if (i != j) {
k = 0;
l = 0;
len_i = strlen(environ[i]);
len_j = strlen(environ[j]);
while (k < len_i && l < len_j) {
if (environ[i][k] != environ[j][l])
break;
if (environ[i][k] == '=')
return 1;
k++;
l++;
}
}
}
}
return 0;
}
|
...
| Code Block | ||
|---|---|---|
| ||
if (putenv("TEST_ENV=foo") != 0) {
/* Handle Errorerror */
}
if (putenv("Test_ENV=bar") != 0) {
/* Handle Errorerror */
}
const char *temp = getenv("TEST_ENV");
if (temp == NULL) {
/* Handle Errorerror */
}
printf("%s\n", temp);
|
On an IA-32 Linux machine with GCC Compiler Version 3.4.4, this code prints:
| Code Block |
|---|
foo |
Whereaswhereas, on an IA-32 Windows XP machine with Microsoft Visual C++ 2008 Express, it prints:
...
| Code Block | ||
|---|---|---|
| ||
if (putenv("TEST_ENV=foo") != 0) {
/* Handle Errorerror */
}
if (putenv("OTHER_ENV=bar") != 0) {
/* Handle Errorerror */
}
const char *temp = getenv("TEST_ENV");
if (temp == NULL) {
/* Handle Errorerror */
}
printf("%s\n", temp);
|
...
An adversary can create multiple environment variables with the same name (for example, by using the POSIX execve() function, for example). If the program checks one copy but uses another, security checks may be circumvented.
...