Page History

The {{getenv()}} function searches an environment list, provided by the host environment, for a string that matches a specified name.  The {{getenv()}} function returns a pointer to a string associated with the matched list member.  It is best not to store this pointer as it may be overwritten by a subsequent call to the {{getenv()}} function \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] or invalidated as a result of otherchanges manipulationmade ofto the environment list through calls to {{putenv()}}, {{setenv()}}, or other means.  Storing the pointer for later use could result in a dangling pointer or a pointer to incorrect data.

According to C99 \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\]:

...

If you do not immediately use and discard this string, make a copy of the value referenced string returned by getenv(), but instead store the pointer somewhere for later use, you could end up with a dangling pointer or a different value altogether so that this copy may be safely referenced at a later time.

Implementation Details

According to the Microsoft Visual Studio 2005/.NET Framework 2.0 help pageshttp://msdn2.microsoft.com/en-us/library/tehxacec(VS.80).aspx:^{Image Removed}

The getenv function searches the list of environment variables for varname. getenv is not case sensitive in the Windows operating system. getenv and _putenv use the copy of the environment pointed to by the global variable _environ to access the environment. getenv operates only on the data structures accessible to the run-time library and not on the environment "segment" created for the process by the operating system. Therefore, programs that use the envp argument to main or wmain may retrieve invalid information.

and

The _putenv and _getenv families of functions are not thread-safe. _getenv could return a string pointer while _putenv is modifying the string, causing random failures. Make sure that calls to these functions are synchronized.

Non-Compliant Coding Example

This code example is non-compliant because the string referenced by pwd may be overwritten as a result of the second call to getenv() function. As a result, it is possible that both pwd and home will refer to the same string.

char *pwd;
char *home;
  
pwd = getenv("PWD");
if (!pwd) return -1;
home = getenv("HOME");
if (!home) return -1;

if (strcmp(pwd, home) == 0) {
  puts("pwd and home are the same.\n");
}
else {
  puts("pwd and home are NOT the same.\n");    
}

Compliant Solution (Windows)

Microsoft Visual Studio 2005 provides provides the ((_dupenv_s()}} and _wdupenv_s() functions for getting a value from the current environment. http://msdn2.microsoft.com/en-us/library/ms175774(VS.80).aspx^{Image Removed}

...

}

...

It is the calling program's responsibility to free the memory by calling free)_.

   char *pValue;
   size_t len;
   errno_t err = _dupenv_s( &pValue, &len, "pathext" );
   if ( err ) return -1;
   printf( "pathext = %s\n", pValue );
   free( pValue );
   err = _dupenv_s( &pValue, &len, "nonexistentvariable" );
   if ( err ) return -1;
   printf( "nonexistentvariable = %s\n", pValue );
   free( pValue ); // It's OK to call free with NULL

Compliant Solution (Windows)

Microsoft Visual Studio 2005 provides provides the ((getenv_s()}} and _wgetenv_s() functions for getting a value from the current environment.

#include <stdlib.h>
#include <stdio.h>

int main( void ) {
   char* libvar;
   size_t requiredSize;

   getenv_s( &requiredSize, NULL, 0, "LIB");

   libvar = (char*) malloc(requiredSize * sizeof(char));
   if (!libvar)
   {
      printf("Failed to allocate memory!\n");
      exit(1);
   }

   // Get the value of the LIB environment variable.
   getenv_s( &requiredSize, libvar, requiredSize, "LIB" );

   if( libvar != NULL )
      printf( "Original LIB variable is: %s\n", libvar );

   // Attempt to change path. Note that this only affects
   // the environment variable of the current process. The command
   // processor's environment is not changed.
   _putenv_s( "LIB", "c:\\mylib;c:\\yourlib" );

   getenv_s( &requiredSize, NULL, 0, "LIB");

   libvar = (char*) malloc(requiredSize * sizeof(char));
   if (!libvar) {
      printf("Failed to allocate memory!\n");
      exit(1);
   }

   // Get the new value of the LIB environment variable. 
   getenv_s( &requiredSize, libvar, requiredSize, "LIB" );

   if( libvar != NULL )
      printf( "New LIB variable is: %s\n", libvar );
}

...

Compliant Solution (Windows)

Microsoft Visual Studio 2005 provides provides the ((_dupenv_s()}} and _wdupenv_s() functions for getting a value from the current environment. http://msdn2.microsoft.com/en-us/library/ms175774(VS.80).aspx^{Image Added}

The _dupenv_s() function searches the list of environment variables for a specified name. If the name is found, a buffer is allocated, the variable's value is copied into the buffer, and the buffer's address and number of elements are returned. By allocating the buffer itself, _dupenv_s() provides a more convenient alternative to getenv_s, _wgetenv_s().

It is the calling program's responsibility to free the memory by calling free)_.

char *pValue;
size_t len;
errno_t err = _dupenv_s(&pValue, &len, "pathext");
if (err) return -1;
printf("pathext = %s\n", pValue);
free(pValue);
err = _dupenv_s(&pValue, &len, "nonexistentvariable");
if (err) return -1;
printf("nonexistentvariable = %s\n", pValue);
free(pValue); // It's OK to call free with NULL

Compliant Solution (POSIX)

...

Examples of vulnerabilities resulting from the violation of this recommendation can be found on the CERT website.

References

\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.20.4, "Communication with the environment" 
\[[Open Group 04|AA. C References#Open Group 04]\] Chapter 8, "Environment Variables", [strdup|http://www.opengroup.org/onlinepubs/009695399/functions/strdup.html]
\[[Viega 03|AA. C References#Viega 03]\] Section 3.6, "Using Environment Variables Securely"
\[[Wheeler 03|AA. C References#Wheeler 03]\] [Section 5.2, "Environment Variables"|http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/environment-variables.html]
\[[Open Group 04|AA. C References#Open Group 04]\] [strdup|http://www.opengroup.org/onlinepubs/009695399/functions/strdup.html]