...
| Code Block | ||||
|---|---|---|---|---|
| ||||
void f() {
char *path = NULL;
/* Avoid assuming $PATH is defined or has limited length */
const char *temp = getenv("PATH");
if (temp != NULL) {
path = (char*) malloc(strlen(temp) + 1);
if (path == NULL) {
/* Handle error condition */
} else {
strcpy(path, temp);
}
/* Use path */
free(path);
}
}
|
Compliant Solution (POSIX or C2x)
In this compliant solution, the strdup() function is used to dynamically allocate a duplicate of the string:
| Code Block | ||||
|---|---|---|---|---|
| ||||
void f() {
char *path = NULL;
/* Avoid assuming $PATH is defined or has limited length */
const char *temp = getenv("PATH");
if (temp != NULL) {
path = strdup(temp);
if (path == NULL) {
/* Handle error condition */
}
/* Use path */
free(path);
}
} |
Risk Assessment
Making assumptions about the size of an environmental variable can result in a buffer overflow.
...
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| LANG.MEM.BO | Buffer overrun | ||||||
| Compass/ROSE | Can detect violations of the rule by using the same method as STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator | ||||||||
| Klocwork |
| ABV.ANY_SIZE_ARRAY ABV.GENERAL ABV.GENERAL.MULTIDIMENSION ABV.ITERATOR ABV.MEMBER ABV.STACK ABV.TAINTED ABV.UNKNOWN_SIZE ABV.UNICODE.BOUND_MAP ABV.UNICODE.FAILED_MAP ABV.UNICODE.NNTS_MAP ABV.UNICODE.SELF_MAP | |||||||
| Parasoft C/C++test |
| CERT_C-ENV01-a | Don't use unsafe C functions that do write to range-unchecked buffers | ||||||
| PC-lint Plus |
| 669 | Fully supported | ||||||
| Polyspace Bug Finder |
| Checks for tainted NULL or non-null-terminated string (rec. partially covered) |
...