Page History

Some functions return a pointer to an object that cannot be modified without causing undefined behavior. These functions include the standard getenv(), setlocale(), localeconv(), asctime(), and strerror() functions. In such cases, the function call results must be treated as being const-qualified.

Subclause The C Standard, 7.2224.4.6, paragraph 4 , of the C Standard  [ISO/IEC 9899:20112024], defines getenv() as follows:

...

If the string returned by getenv() must be altered, a local copy should be created. Altering the string returned by getenv() results in is undefined behavior. (See undefined behavior 184.)

Similarly, subclause 7.11.1.1, paragraph 8 [ISO/IEC 9899:20112024], defines setlocale() as follows:

The pointer to string returned by the setlocale function is such that a subsequent call with that string value and its associated category will restore that part of the program'€™s locale. The string pointed to shall not be modified by the program, but may be overwritten by a subsequent call to the setlocale function.

 And subclause 7.11.2.1.2, paragraph 8 [ISO/IEC 9899:20112024], defines localeconv() as follows:

...

Altering the string returned by setlocale() or the structure returned by localeconv() results in are undefined behaviors. (See undefined behaviors 120 and 121.) Furthermore, the C Standard imposes no requirements on the contents of the string by setlocale(). Consequently, no assumptions can be made as to the string's internal contents or structure.

Finally, subclause 7.2426.6.23, paragraph 4 4 [ISO/IEC 9899:20112024], states:

The The strerror function returns a pointer to the string, the contents of which are locale-specific. The array pointed to shall not be modified by the program, but may be overwritten by . The behavior is undefined if the returned value is used after a subsequent call to the strerror functionthe strerror function, or after the thread which called the function to obtain the returned value has exited.

Altering the string returned by strerror() results in is undefined behavior. (See undefined behavior 184.)

Noncompliant Code Example (getenv())

This noncompliant code example modifies the string returned by getenv() by replacing all double quote quotation marks (") characters with underscores (_):

#include <stdlib.h>
 
void trstr(char *c_str, char orig, char rep) {
  while (*c_str != '\0') {
    if (*c_str == orig) {
      *c_str = rep;
    }
    ++c_str;
  }
}

void func(void) {
  char *env = getenv("TEST_ENV");
  if (env == NULL) {
    /* Handle error */
  }
  trstr(env,'"', '_');
}

Compliant Solution (getenv()) (

...

Environment Not Modified)

If the intent of the noncompliant code example is to use the modified value of the environment variable locally and not programmer does not intend to modify the environment, this compliant solution makes demonstrates how to modify a local copy of that string value and then modifies itthe return value:

#include <stdlib.h>
#include <string.h>
 
void trstr(char *c_str, char orig, char rep) {
  while (*c_str != '\0') {
    if (*c_str == orig) {
      *c_str = rep;
    }
    ++c_str;
  }
}
 
void func(void) {
  const char *env;
  char *copy_of_env;

  env = getenv("TEST_ENV");
  if (env == NULL) {
    /* Handle error */
  }

  copy_of_env = (char *)malloc(strlen(env) + 1);
  if (copy_of_env == NULL) {
    /* Handle error */
  }

  strcpy(copy_of_env, env);
  trstr(copy_of_env,'\"', '_');
  /* ... */
  free(copy_of_env);
}

Compliant Solution (getenv()) (Modifying the Environment in POSIX)

If the programmer's intent is to modify the environment, this compliant solution, which saves the altered string back into the environment by using the POSIX setenv() and strdup() functions, can be used:

#include <stdlib.h>
#include <string.h>
 
void trstr(char *c_str, char orig, char rep) {
  while (*c_str != '\0') {
    if (*c_str == orig) {
      *c_str = rep;
    }
    ++c_str++;
  }
}
 
void func(void) {
  const char *env;
  char *copy_of_env;

  env = getenv("TEST_ENV");
  if (env == NULL) {
    /* Handle error */
  }

  copy_of_env = strdup(env);
  if (copy_of_env == NULL) {
    /* Handle error */
  }

  trstr(copy_of_env,'\"', '_');

  if (setenv("TEST_ENV", copy_of_env, 1) != 0) {
    /* Handle error */
  }
  /* ... */
  free(copy_of_env);
}

Noncompliant Code Example (localeconv())

In this noncompliant example, the object returned from the C standard library function by localeconv() is directly modified:

#include <locale.h>
 
void f2(void) {
  struct lconv *conv = localeconv();
 
  if ('\0' == conv->decimal_point[0]) {
    conv->decimal_point = ".";
  }
}

Compliant Solution (localeconv()) (

...

Copy)

This compliant solution makes modifies a local copy of the object and then modifies itreturned by localeconv():

#include <locale.h>
#include <stdlib.h>
#include <string.h>
 
void f2(void) {
  const struct lconv *conv = localeconv();
  struct lconv *copy_of_conv;
  if (conv == NULL) {
     /* Handle error */
  }
  
  struct lconv *copy_of_conv = (struct lconv *)malloc(
    sizeof(struct lconv));
  if (copy_of_conv == NULL) {
    /* Handle error */
  }
 
  memcpy(copy_of_conv, conv, sizeof(struct lconv));
 
  if ('\0' == copy_of_conv->decimal_point[0]) {
    copy_of_conv->decimal_point = ".";  
  }
  /* ... */
  free(copy_of_conv);
}

Risk Assessment

Modifying the object pointed to by the return value of these functions causes of getenv(), setlocale(), localeconv(), asctime(), or strerror() is undefined behavior. Even if the modification succeeds, the modified object can be overwritten by a subsequent call to the getenv(), setlocale(), localeconv(), or strerror() functionssame function.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

Bibliography

...

Image Modified Image Modified Image Modified