Page History

Do not make any assumptions about the size of environment variables , because an adversary might have full control over the environment. If the environment variable needs to be stored, then the length of the associated string should be calculated , and the storage dynamically allocated (see STR31-C. Guarantee that storage for strings has sufficient space for character data and the NULL null terminator).

Noncompliant Code Example

This noncompliant code example copies the string returned by getenv() into a fixed-size buffer.:

void f() {
  char copypath[16PATH_MAX];
const char /*temp = getenv("TEST_ENV");
if (temp != NULL) {Requires PATH_MAX to be defined */
  strcpy(copypath, tempgetenv("PATH"));
  /* Use path */
}

However, the string copied from temp may exceed the size of copy, leading to a buffer overflow.Even if your platform assumes that $PATH is defined, defines PATH_MAX, and enforces that paths not have more than PATH_MAX characters, the $PATH environment variable still is not required to have less than PATH_MAX chars. And if it has more than PATH_MAX chars, a buffer overflow will result. Also, if $PATH is not defined, then strcpy() will attempt to dereference a null pointer.

Compliant Solution

In the following this compliant solution, the strlen() function is used to calculate the size of the string, and the required space is dynamically allocated.:

void f() {
  char *copypath = NULL;
  /* Avoid assuming $PATH is defined or has limited length */
  const char *temp = getenv("TEST_ENVPATH");
  if (temp != NULL) {
    copypath = (char *) malloc(strlen(temp) + 1);
    if (copypath !== NULL) {
      /* Handle error condition */
    } else {
      strcpy(copypath, temp);
    }
    /* Use path */
    free(path);
  }
}

Compliant Solution (POSIX or C2x)

In this compliant solution, the strdup() function is used to dynamically allocate a duplicate of the string:

void f() {
  char *path = NULL;
  /* Avoid assuming $PATH is defined or has limited length */
  const char *temp = getenv("PATH");
   elseif (temp != NULL) {
    path = strdup(temp);
    if (path == NULL) {
      /* Handle error condition */
    }
    /* Use path */
    free(path);
  }
}

Risk Assessment

Making assumptions about the size of an environmental variable can result in a buffer overflow.

Automated Detection

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C++ Secure Coding Standard as ENV01-CPP. Do not make assumptions about the size of an environment variable.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.20.4, "Communication with the environment"
\[[MITRE 07|AA. C References#MITRE 07]\] [CWE ID 119|http://cwe.mitre.org/data/definitions/119.html], "Failure to Constrain Operations within the Bounds of an Allocated Memory Buffer"
\[[Open Group 04|AA. C References#Open Group 04]\] Chapter 8, "Environment Variables"
\[[Viega 03|AA. C References#Viega 03]\] Section 3.6, "Using Environment Variables Securely"

Related Guidelines

Bibliography

...

Image Added Image Added ENV00-C. Do not store the pointer to the string returned by getenv()      10. Environment (ENV)      Image Modified