Page History

Wiki MarkupDo not make any assumptions about the size of environment variables , as because an adversary could might have full control over the environment. Calculate the length of the strings yourself, and dynamically allocate memory for your copies \[[STR31-C|If the environment variable needs to be stored, the length of the associated string should be calculated and the storage dynamically allocated (see STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator]\]).

...

Noncompliant Code Example

This non-compliant noncompliant code example copies the string returned by getenv() into a fixed-size buffer. This can result in a buffer overflow.:

void f() {
  char path[PATH_MAX]; /* Requires PATH_MAX to be defined */
char *temp;
char copy[16];

temp = getenv("TEST_ENV");
if (temp != NULL) {
  strcpy(buffpath, tempgetenv("PATH"));
  /* Use path */
}

Even if your platform assumes that $PATH is defined, defines PATH_MAX, and enforces that paths not have more than PATH_MAX characters, the $PATH environment variable still is not required to have less than PATH_MAX chars. And if it has more than PATH_MAX chars, a buffer overflow will result. Also, if $PATH is not defined, then strcpy() will attempt to dereference a null pointer.

Compliant Solution

Use In this compliant solution, the strlen() function is used to calculate the size of the string, and dynamically allocate the required space .is dynamically allocated:

char *temp;
void f() {
  char *copypath = NULL;

if ((  /* Avoid assuming $PATH is defined or has limited length */
  const char *temp = getenv("TEST_ENVPATH"));
  if (temp != NULL) {
   copy path = (char*) malloc(strlen(temp) + 1);
    if (copypath !== NULL) {
      /* Handle error condition */
    } else {
      strcpy(copypath, temp);
    }
    /* Use path */
    free(path);
  }
}

Compliant Solution (POSIX or C2x)

In this compliant solution, the strdup() function is used to dynamically allocate a duplicate of the string:

void f() {
  char *path = NULL;
  /* Avoid assuming $PATH is defined or has limited length */
  const char *temp = getenv("PATH");
  if (temp != NULL) {
    path = strdup(temp);
    if  else(path == NULL) {
      /* handleHandle error condition */
    }
    /* Use path */
    free(path);
  }
}

Risk Assessment

Making assumptions about the size of an environmental variable could can result in a buffer overflow attack.

References

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...

Image Added Image Added Image Added Wiki Markup\[[ISO/IEC 9899-1999:TC2|AA. C References#ISO/IEC 9899-1999TC2]\] Section 7.20.4, "Communication with the environment" \[[Open Group 04|AA. C References#Open Group 04]\] Chapter 8, "Environment Variables" \[[Viega 03|AA. C References#Viega 03]\] Section 3.6, "Using Environment Variables Securely"