Page History

The {{getenv()}} function searches an environment list, provided by the host environment, for a string that matches a specified

 name.  The {{getenv()}} function returns a pointer to a string associated with the matched list member.  It is best not to store this pointer as it may be overwritten by a subsequent call to the {{getenv()}} function \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] or invalidated as a result of other manipulation of the environment list.

According to C99 \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\]:

...

If you do not immediately make a copy of the value returned by getenv(), but instead store the pointer somewhere for later use, you could end up with a dangling pointer or a different value altogether.

Implementation Details

According to the Microsoft Visual Studio 2005/.NET Framework 2.0 help pages http://msdn2.microsoft.com/en-us/library/tehxacec(VS.80).aspx:

The getenv function searches the list of environment variables for varname. getenv is not case sensitive in the Windows operating system. getenv and _putenv use the copy of the environment pointed to by the global variable _environ to access the environment. getenv operates only on the data structures accessible to the run-time library and not on the environment "segment" created for the process by the operating system. Therefore, programs that use the envp argument to main or wmain may retrieve invalid information.

Non-Compliant Coding Example

char *pwd;
char *home;
  
pwd = getenv("PWD");
if (!pwd) return -1;
home = getenv("HOME");
if (!home) return -1;

if (strcmp(pwd, home) == 0) {
  puts("pwd and home are the same.\n");
}
else {
  puts("pwd and home are NOT the same.\n");    
}

Compliant Solution (Windows)

Microsoft Visual Studio 2005 provides provides the ((_dupenv_s()}} and _wdupenv_s() functions for getting a value from the current environment. http://msdn2.microsoft.com/en-us/library/ms175774(VS.80).aspx

...

   char *pValue;
   size_t len;
   errno_t err = _dupenv_s( &pValue, &len, "pathext" );
   if ( err ) return -1;
   printf( "pathext = %s\n", pValue );
   free( pValue );
   err = _dupenv_s( &pValue, &len, "nonexistentvariable" );
   if ( err ) return -1;
   printf( "nonexistentvariable = %s\n", pValue );
   free( pValue ); // It's OK to call free with NULL

Compliant Solution (Windows)

Microsoft Visual Studio 2005 provides provides the ((getenv_s()}} and _wgetenv_s() functions for getting a value from the current environment.

...

There is a race condition here even after you call getenv() and before you copy. Be careful to only manipulate the process environment from a single thread at a time.

Compliant Solution (POSIX)

The following compliant solution depends on the POSIX strdup() function to make a copy of the environment variable string.

char *tmpvar = strdup(getenv("TMP"));

If the TMP environmental variable returns does not exist, the call to getenv() returns NULL. In these cases, the call to strdup() should also return NULL, but it is important to verify this as this behavior is not guaranteed by POSIX OpenGroup 05

Risk Assessment

Examples of vulnerabilities resulting from the violation of this recommendation can be found on the CERT website.

References

\[[Dowd 06|AA. C References#Dowd 06]\] Chapter 10, "UNIX II: Processes"
\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.20.4, "Communication with the environment" 
\[[Open Group 04|AA. C References#Open Group 04]\] Chapter 8, "Environment Variables"
\[[Viega 03|AA. C References#Viega 03]\] Section 3.6, "Using Environment Variables Securely"
\[[Wheeler 03|AA. C References#Wheeler 03]\] [Section 5.2, "Environment Variables"|http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/environment-variables.html]
\[[Open Group 04|AA. C References#Open Group 04]\] [strdup|http://www.opengroup.org/onlinepubs/009695399/functions/strdup.html]