Page History

Some functions return a pointer to an object that cannot be modified without causing undefined behavior. These functions include the standard getenv(), setlocale(), localeconv(), and strerror() functions. In such cases, the function call results must be treated as being const qualified.

Subclause 7.22.4.6 paragraph 4 of the C Standard [ISO/IEC 9899:2011] defines getenv() as follows:

The getenv function returns a pointer to a string associated with the matched list member. The string pointed to shall not be modified by the program, but may be overwritten by a subsequent call to the getenv function. If the specified name cannot be found, a null pointer is returned.

...

Similarly, subclause 7.11.1.1 1 paragraph 8 [ISO/IEC 9899:2011] defines setlocale and localeconv () as follows:

The pointer to string returned by the setlocale function is such that a subsequent call with that string value and its associated category will restore that part of the program'€™s locale. The string pointed to shall not be modified by the program, but may be overwritten by a subsequent call to the setlocale function.

 And subclause 7.11.1.2 paragraph 8 [ISO/IEC 9899:2011] defines localeconv() as follows:

The localeconv function returns a pointer to the filled-in object. The structure pointed to by the return value shall not be modified by the program, but may be overwritten by a subsequent call to the localeconv function. In addition, calls to the setlocale function with categories LC_ALL, LC_MONETARY, or LC_NUMERIC may overwrite the contents of the structure.

Altering the string returned by setlocale() or the structure returned by localeconv() results in undefined behavior. See also undefined behaviors 120 and 121 of Annex J. Furthermore, the C Standard imposes no requirements on the contents of the string by setlocale(). Consequently, a program should make no assumptions as to the string's internal contents or structure.

Finally, subclause 7.24.6.2 paragraph 4 [ISO/IEC 9899:2011] states:

The strerror function returns a pointer to the string, the contents of which are locale-specific. The array pointed to shall not be modified by the program, but may be overwritten by a subsequent call to the strerror function.

...

#include <stdlib.h>
 
void trstr(char *str, char orig, char rep) {
  while (*str != '\0') {
    if (*str == orig) {
      *str = rep;
    }
    str++str;
  }
}

void func(void) {
  char *env = getenv("TEST_ENV");
  if (env == NULL) {
    /* Handle error */
  }

  trstr(env,'"', '_');
}

Compliant Solution (getenv()) (Local Copy)

...

#include <stdlib.h>
#include <string.h>
 
void trstr(char *str, char orig, char rep) {
  while (*str != '\0') {
    if (*str == orig) {
      *str = rep;
    }
    str++str;
  }
}
 
void func(void) {
  const char *env;
  char *copy_of_env;

  env = getenv("TEST_ENV");
  if (env == NULL) {
    /* Handle error */
  }

  copy_of_env = (char *)malloc(strlen(env) + 1);
  if (copy_of_env == NULL) {
    /* Handle error */
  }

  strcpy(copy_of_env, env);
  trstr(copy_of_env,'\"', '_');
  /* ... */
}

Compliant Solution (getenv()) (Modifying the Environment in POSIX)

...

#include <locale.h>
 
void f2(void) {
  struct lconv *conv = localeconv();
 
  if ('\0' == conv->decimal_point[0]) {
    conv->decimal_point = ".";
  }
 
  if ('\0' == conv->thousands_sep[0]) {
    conv->thousands_sep = ",";
  }
}

Compliant Solution (localeconv()) (Local Copy)

...

#include <locale.h>
#include <stdlib.h>
#include <string.h>
 
void f2(void) {
  const struct lconv *conv = localeconv();
  struct lconv *copy_of_conv;
  if (conv == NULL) {
     /* Handle error */
  }
  
  copy_of_conv = (struct lconv *)malloc(sizeof(struct lconv));
  if (copy_of_conv == NULL) {
    /* Handle error */
  }
 
  memcpy(copy_of_conv, conv, sizeof(struct lconv));
 
  if ('\0' == copy_of_conv->decimal_point[0]) {
    copy_of_conv->decimal_point = ".";  
  }
 
  if ('\0' == copy_of_conv->thousands_sep[0]) {
    copy_of_conv->thousands_sep = ","; 
  }
}

Risk Assessment

Depending on the implementation, modifying the Modifying the object pointed to by the return value of these functions causes undefined behavior. Even if the modification succeeds, the modified object can be overwritten by a subsequent call to the getenv(), setlocale(), localeconv(), or strerror() functions.

...

...