Page History

Some funcitons functions return a pointer to a an object that cannot be modified without causing undefined behavior. These functions include the standard getenv(), setlocale(), and localeconvlocaleconv(), asctime(), and strerror() functions... In such cases, the function call results must be treated as being const-qualified.

The C Standard, 7.24.4.6, paragraph 4 Wiki MarkupC99 \[ [ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] defines {{getenv}} as 2024], defines getenv() as follows:

The getenv function returns a pointer to a string associated with the matched list member. The string pointed to shall not be modified by the program, but may be overwritten by a subsequent call to the getenv function. If the specified name cannot be found, a null pointer is returned.

Consequently, if If the string returned by getenv() needs to must be altered, a local copy should be created to ensure that the environment is not directly and unintentionally modified.. Altering the string returned by getenv() is undefined behavior. (See undefined behavior 184.)

Similarly, subclause 7.11.1.1, paragraph 8 Wiki MarkupSimilarly, C99 \[ [ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] defines {{setlocale}} and {{localeconv}} as 2024], defines setlocale() as follows:

The pointer to string returned by the setlocale function is such that a subsequent call with that string value and its associated category will restore that part of the program’s program'€™s locale. The string pointed to shall not be modified by the program, but may be overwritten by a subsequent call to the setlocale function.

 And subclause 7.11.2.1, paragraph 8 [ISO/IEC 9899:2024], defines localeconv() as follows:

The localeconv function returns a pointer to the filled-in object. The structure pointed to by the return value shall not be modified by the program, but may be overwritten by a subsequent call to the localeconv function. In addition, calls to the setlocale function with categories LC_ALL, LC_MONETARY, or LC_NUMERIC may overwrite the contents of the structure.

Altering the string returned by setlocale() or the structure returned by localeconv() results in undefined behavior.

...

are undefined behaviors. (See undefined behaviors 120 and 121.) Furthermore, the C Standard imposes no requirements on the contents of the string by setlocale(). Consequently, no assumptions can be made as to the string's internal contents or structure.

Finally, subclause 7.26.6.3, paragraph 4 [ISO/IEC 9899:2024], states

The strerror function returns a pointer to the string, the contents of which are locale-specific. The array pointed to shall not be modified by the program. The behavior is undefined if the returned value is used after a subsequent call to the strerror function, or after the thread which called the function to obtain the returned value has exited.

Altering the string returned by strerror() is undefined behavior. (See undefined behavior 184.)

Noncompliant Code Example (getenv())

This noncompliant code example modifies the string returned by getenv() by replacing all double quote quotation marks (") characters with underscores .(_):

#include <stdlib.h>
 
void strtrtrstr(char *c_str, char orig, char rep) {
  while (*c_str != '\0') {
    if (*c_str == orig) {
      *c_str = rep;
    }
    str++c_str;
  }
}

/* ... */

void func(void) {
  char *env = getenv("TEST_ENV");
  if (env == NULL) {
    /* Handle error */
  }

strtr  trstr(env,'"', '_');


/* ... */}

Compliant Solution (

...

getenv()) (Environment Not Modified)

If the programmer does not intend to For the case where the intent of the noncompliant code example is to use the modified value of the environment variable locally and not modify the environment, this compliant solution makes demonstrates how to modify a local copy of that string value and then modifies the local copy.the return value:

#include <stdlib.h>
#include <string.h>
 
void trstr(char *c_str, char orig, char rep) {
  while (*c_str != '\0') {
    if (*c_str == orig) {
      *c_str = rep;
    }
    ++c_str;
  }
}
 
void func(void) {
  const char *env;
  char *copy_of_env;

  env = getenv("TEST_ENV");
  if (env == NULL) {
    /* Handle error */
  }

  copy_of_env = (char *)malloc(strlen(env) + 1);
  if (copy_of_env == NULL) {
    /* Handle error */
  }

  strcpy(copy_of_env, env);
strtr  trstr(copy_of_env,'\"', '_');
  /* ... */
  free(copy_of_env);
}

Compliant Solution (getenv()) (Modifying the Environment in POSIX)

For the case where the If the programmer's intent is to modify the environment, this compliant solution, which saves the altered string back into the environment by using the POSIX setenv() and strdup() functions., can be used:

#include <stdlib.h>
#include <string.h>
 
void trstr(char *c_str, char orig, char rep) {
  while (*c_str != '\0') {
    if (*c_str == orig) {
      *c_str = rep;
    }
    ++c_str;
  }
}
 
void func(void) {
  const char *env;
  char *copy_of_env;

  env = getenv("TEST_ENV");
  if (env == NULL) {
    /* Handle error */
  }

  copy_of_env = strdup(env);
  if (copy_of_env == NULL) {
    /* Handle error */
  }

strtr  trstr(copy_of_env,'\"', '_');

  if (setenv("TEST_ENV", copy_of_env, 1) != 0) {
    /* Handle error */
  }
  /* ... */
  free(copy_of_env);
}

Noncompliant Code Example

...

(localeconv())

In this noncompliant example, the object returned by localeconv() is directly modified:This noncompliant code example modifies the string returned by setlocale() by terminating the string when '.' is encountered such as “en_US.iso88591” to “en_US”. In this case, the behavior is undefined.

#include <locale.h>
 
void terminate_on_dot(char *str)f2(void) {
  int i;

  for (i = 0; i < strlen(locale); i++){
    if(locale[i] == '.'){
      locale[i] = ‘\0’;
      break;
    }
  }
}

/* ... */

char *locale = setlocale(LC_ALL, "");
if (locale == NULL) {
  /* Handle error */
}

terminate_on_dot(locale);

/* ... */

Compliant Solution

Similar to the case of getenv(), this compliant solution makes a local copy of that string value and then modifies the local copy.

struct lconv *conv = localeconv();
 
  if ('\0' == conv->decimal_point[0]) {
    conv->decimal_point = ".";
  }
}

Compliant Solution (localeconv()) (Copy)

This compliant solution modifies a copy of the object returned by localeconv():

#include <locale.h>
#include <stdlib.h>
#include <string.h>
 
void f2(void) {
  const struct lconv *conv = localeconv();
  if (conv

const char *locale;
char *copy_of_locale;

locale = setlocale(LC_ALL, "");
if (locale == NULL) {
     /* Handle error */
  }
  
  struct lconv *copy_of_localeconv = (charstruct lconv *)malloc(strlen(locale) + 1
    sizeof(struct lconv));
  if (copy_of_localeconv == NULL) {
    /* Handle error */
  }
 
strcpy  memcpy(copy_of_localeconv, conv, localesizeof(struct lconv));
terminate_on_dot( 
  if ('\0' == copy_of_conv->decimal_point[0]) {
    copy_of_locale);

conv->decimal_point = ".";  
  }
  /* ... */
  free(copy_of_conv);
}

Risk Assessment

The modified object may be overwritten by a subsequent call to the Modifying the object pointed to by the return value of getenv(), setlocale(), or localeconv() functions. Depending on the implementation, modifying the object pointed to by the return value of these functions causes undefined behavior localeconv(), asctime(), or strerror() is undefined behavior. Even if the modification succeeds, the modified object can be overwritten by a subsequent call to the same function.

Automated Detection

...

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C++ Secure Coding Standard as ENV30-CPP. Do not modify the string returned by getenv().

References

...

Related Guidelines

Key here (explains table format and definitions)

Bibliography

...

...

...

Image Added Image Added “The {{localeconv}} function” \[[Open Group 04|AA. C References#Open Group 04]\] [getenv|http://www.opengroup.org/onlinepubs/000095399/functions/getenv.html], [setlocale|http://www.opengroup.org/onlinepubs/009695399/functions/setlocale.html], [localeconv|http://www.opengroup.org/onlinepubs/009695399/functions/localeconv.html]ENV04-C. Do not call system() if you do not need a command processor      10. Environment (ENV)      Image Modified