Page History

main(int argc, char *argv[], char *envp[]){ /* ... */ }

#include <stdio.h>
#include <stdlib.h>
 
extern char **environ;

int main(int argc, const char *argv[], const char *envp[]) {
  printf("environ:  %p\n", environ);
  printf("envp:     %p\n", envp);
  setenv("MY_NEW_VAR", "new_value", 1);
  puts("--Added MY_NEW_VAR--");
  printf("environ:  %p\n", environ);
  printf("envp:     %p\n", envp);
  return 0;
}

% ./envp-environ
environ: 0xbf8656ec
envp:    0xbf8656ec
--Added MY_NEW_VAR--
environ: 0x804a008
envp:    0xbf8656ec

#include <stdio.h>
#include <stdlib.h>
 
int main(int argc, const char *argv[], const char *envp[]) {
  if (setenv("MY_NEW_VAR", "new_value", 1) != 0) {
    /* Handle error */
  }
  if (envp

If an environment variable might have changed during program execution, get a fresh copy using {{getenv()}}. If you rely on your old variable, you could be left with incorrect data or a dangling pointer.

h2. Non-Compliant Coding Example

After a call to {{setenv()}}, environment pointers to the old value and copies of the old value will be incorrect.
{code:bgColor=#ccffcc}
char *temp;
char *copy;

if ((temp = getenv("TEST_ENV")) != NULL) {
  copy = malloc(strlen(temp) + 1);
  if (copy != NULL) {
    for strcpy(copy, temp);
  }
  else {
    /* handle error condition */
  }
}
/* ...program code... */
setenv("TEST_ENV", var, 1);
/* ...program code... */


printf("TEST_ENV: %s\n", temp);
printf("TEST_ENV: %s\n", copy);
{code}
Neither of the print statements will be correct.

h2. Compliant Solution

You should always fetch fresh copies of environment variables, especially if you know that a value has changed.
{code:bgColor=#ccccff}
char \*temp;
char \*copy;

if ((temp = getenv("TEST_ENV")) \!= NULL) {
copy = malloc(strlen(temp) + 1);
if (copy \!= NULL)
{     strcpy(copy, temp);   }
else {
/* handle error condition */
}
}
/* ...program code... */
setenv("TEST_ENV", var, 1);
/* ...program code... */

if ((temp = getenv("TEST_ENV")) != NULL) {
copy = malloc(strlen(temp) + 1);
if (copy(size_t i = 0; envp[i] != NULL; ++i) {
      puts(envp[i]);
    }
  }
  return 0;
}

#include <stdio.h>
#include <stdlib.h>
 
extern char **environ;

int main(void) {
  if (setenv("MY_NEW_VAR", "new_value", 1) != 0) {
    /* Handle error */
  }
  if (environ != NULL) {
    for (size_t i = 0; environ[i] != NULL; ++i) {
      puts(environ[i]);
    }
  }
  return 0;
}

#include <stdio.h>
#include <stdlib.h>
 
int main(int argc, const char *argv[], const char *envp[]) {
  if (_putenv_s("MY_NEW_VAR", "new_value") != 0) {
    /* Handle error */
  }
  if (envp != NULL) {
    for (size_t i = 0; envp[i] != NULL; ++i) {
      puts(envp[i]);
    }
  }
  return 0;
}

#include <stdio.h>
#include <stdlib.h>
 
_CRTIMP extern char **_environ;

int main(int argc, const char *argv[]) {
  if (_putenv_s("MY_NEW_VAR", "new_value") != 0) {
    /* Handle error */
  }
  if (_environ != NULL) {
    strcpy(copy, temp);  }
}
else
{     /* handle error condition */for (size_t i = 0; _environ[i] != NULL; ++i) {
      puts(_environ[i]);
    }
  }
printf("TEST_ENV: %s\n", temp);
printf("TEST_ENV: %s\n", copy);
This will provide us with the current value of the environment variable.

h2. Risk Assessment

The program would not be using current environment values, causing unexpected results.
|| Rule || Severity || Likelihood || Remediation Cost || Priority || Level ||
| ENV31-C | *1* (low) | *1* (low) | *3* (low) | {color:green}{*}P3{*}{color} | {color:green}{*}L3{*}{color} |

h2. References

\[[ISO/IEC 9899-1999:TC2|AA. C References#ISO/IEC 9899-1999TC]\] Section 7.20.4, "Communication with the environment"return 0;
}

int main(int argc, char *argv[], char *envp[]) {
  /* ... */
}

#if defined (_POSIX_) || defined (__USE_POSIX)
  extern char **environ;
  #define envp environ
#elif defined(_WIN32)
  _CRTIMP extern char **_environ;
  #define envp _environ
#endif

int main(int argc, char *argv[]) {
  /* ... */
}