SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 104

changes.mady.by.user Jill Britton

Saved on

compared with

New Version Current

changes.mady.by.user Caden Milne

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Updated references from C11->C23

The C Standard, 7.2224.4.6, paragraph 4 4 [ISO/IEC 9899:20112024], states

The getenv function returns a pointer to a string associated with the matched list member. The string pointed to shall not be modified by the program but may be overwritten by a subsequent call to the getenv function. If the specified name cannot be found, a null pointer is returned.

This paragraph gives an implementation the latitude, for example, to return a pointer to a statically allocated buffer. Consequently, do not store this pointer because the string data it points to may be overwritten by a subsequent call to the getenv() function or invalidated by modifications to the environment. This string should be referenced immediately and discarded. If later use is anticipated, the string should be copied so the copy can be safely referenced as needed.

...

C2681 C2682 C2683

C++2681, C++2682, C++2683

2681, 2682, 2683 

Tool

Version

Checker

Description

Compass/ROSE




Cppcheck Premium
24.9.0
premium-cert-env34-c

Fully implemented

Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

DF2681,

DF2682,

DF2683


Klocwork
Include Page
Klocwork_V
Klocwork_V

MISRA.STDLIB.ILLEGAL_REUSE.2012_AMD1


LDRA tool suite
Include Page
LDRA_V
LDRA_V

133 D

Fully implemented
Parasoft C/C++test

Include Page
Parasoft_V
Parasoft_V

CERT_C-ENV34-a

Pointers returned by certain Standard Library functions should not be used following a subsequent call to the same or related function

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rule ENV34-CChecks for misuse of return value from nonreentrant standard function (rule fully covered)PRQA QA-C
Include Page
PRQA QA-C_vPRQA QA-C_vPRQA QA-C++
Include Page
cplusplus:PRQA QA-C++_Vcplusplus:PRQA QA-C++_V2681, 2682, 2683

Related Guidelines

Key here (explains table format and definitions)

...

[IEEE Std 1003.1:2013]Chapter 8, "Environment Variables"
XSH, System Interfaces, strdup
[ISO/IEC 9899:20112024]Subclause 7.2224.4, "Communication with the Environment"
Subclause 7.2224.4.6, "The getenv Function"
Subclause K.3.6.2.1, "The getenv_s Function"
[MSDN]_dupenv_s(), _wdupenv_s()
[Viega 2003]Section 3.6, "Using Environment Variables Securely"

...