Page History

Some implementations provide a nonportable environment pointer that is valid when main() is called but may be invalidated by operations that modify the environment.

The C Standard, J.5.1 2 [ISO/IEC 9899:20112024], states

In a hosted environment, the main function receives a third argument, char *envp[], that points to a null-terminated array of pointers to char, each of which points to a string that provides information about the environment for this execution of the program (5.1.2.3.2).

Consequently, under a hosted environment supporting this common extension, it is possible to access the environment through a modified form of main():

...

Because envp may no longer point to the current environment, this program has undefined unanticipated behavior.

Compliant Solution (POSIX)

...

Because envp no longer points to the current environment, this program has undefined unanticipated behavior.

Compliant Solution (Windows)

...

Using the envp environment pointer after the environment has been modified can result in undefined behavior.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

Bibliography

...

...