ENV30-C. Do not modify the object referenced by the return value of certain functions

Some funcitons return a pointer to a object that cannot be modified without causing undefined behavior. These functions include the standard getenv(), setlocale(), and localeconv() functions..

C99 [[ISO/IEC 9899:1999]] defines getenv as follows:

The getenv function returns a pointer to a string associated with the matched list member. The string pointed to shall not be modified by the program, but may be overwritten by a subsequent call to the getenv function. If the specified name cannot be found, a null pointer is returned.

Consequently, if the string returned by getenv() needs to be altered, a local copy should be created to ensure that the environment is not directly and unintentionally modified.

Similarly, C99 [[ISO/IEC 9899:1999]] defines setlocale and localeconv as follows:

The pointer to string returned by the setlocale function is such that a subsequent call with that string value and its associated category will restore that part of the program’s locale. The string pointed to shall not be modified by the program, but may be overwritten by a subsequent call to the setlocale function.

The localeconv function returns a pointer to the filled-in object. The structure pointed to by the return value shall not be modified by the program, but may be overwritten by a subsequent call to the localeconv function.

Altering the string returned by setlocale() or the structure returned by localeconv() results in undefined behavior.

Noncompliant Code Example

This noncompliant code example modifies the string returned by getenv() by replacing all double quote (") characters with underscores.

void strtr(char *str, char orig, char rep) {
  while (*str != '\0') {
    if (*str == orig) {
      *str = rep;
    }
    str++;
  }
}

/* ... */

char *env = getenv("TEST_ENV");
if (env == NULL) {
  /* Handle error */
}

strtr(env,'"', '_');


/* ... */

Compliant Solution (local copy)

For the case where the intent of the noncompliant code example is to use the modified value of the environment variable locally and not modify the environment, this compliant solution makes a local copy of that string value and then modifies the local copy.

const char *env;
char *copy_of_env;

env = getenv("TEST_ENV");
if (env == NULL) {
  /* Handle error */
}

copy_of_env = (char *)malloc(strlen(env) + 1);
if (copy_of_env == NULL) {
  /* Handle error */
}

strcpy(copy_of_env, env);
strtr(copy_of_env,'\"', '_');

Compliant Solution (Modifying the Environment in POSIX)

For the case where the intent is to modify the environment, this compliant solution saves the altered string back into the environment by using the POSIX setenv() and strdup() functions.

const char *env;
char *copy_of_env;

env = getenv("TEST_ENV");
if (env == NULL) {
  /* Handle error */
}

copy_of_env = strdup(env);
if (copy_of_env == NULL) {
  /* Handle error */
}

strtr(copy_of_env,'\"', '_');

if (setenv("TEST_ENV", copy_of_env, 1) != 0) {
  /* Handle error */
}

Noncompliant Code Example

This noncompliant code example modifies the string returned by setlocale() by terminating the string when '.' is encountered such as “en_US.iso88591” to “en_US”. In this case, the behavior is undefined.

void terminate_on_dot(char *str){
  int i;

  for (i = 0; i < strlen(locale); i++){
    if(locale[i] == '.'){
      locale[i] = ‘\0’;
      break;
    }
  }
}

/* ... */

char *locale = setlocale(LC_ALL, "");
if (locale == NULL) {
  /* Handle error */
}

terminate_on_dot(locale);

/* ... */

Compliant Solution

Similar to the case of getenv(), this compliant solution makes a local copy of that string value and then modifies the local copy.

const char *locale;
char *copy_of_locale;

locale = setlocale(LC_ALL, "");
if (locale == NULL) {
  /* Handle error */
}

copy_of_locale = (char *)malloc(strlen(locale) + 1);
if (copy_of_locale == NULL) {
  /* Handle error */
}

strcpy(copy_of_locale, locale);
terminate_on_dot(copy_of_locale);

/* ... */

Risk Assessment

The modified object may be overwritten by a subsequent call to the getenv(), setlocale(), or localeconv() functions. Depending on the implementation, modifying the object pointed to by the return value of these functions causes undefined behavior

Automated Detection

Compass/ROSE can detect violations of this rule. In particular, it ensures that the result of getenv() is stored into a const variable.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C++ Secure Coding Standard as ENV30-CPP. Do not modify the string returned by getenv().

References

[[ISO/IEC 9899:1999]] Section 7.20.4.5, "The getenv function", Section 7.11.1.1, “The setlocale function”, Section 7.11.2.1, “The localeconv function”
[[Open Group 04]] getenv, setlocale, localeconv

ENV04-C. Do not call system() if you do not need a command processor      10. Environment (ENV)