Upon successful completion, getenv() function returns a pointer to a null-terminated string containing the value of a specified environmental variable. If the specified variable cannot be found the environment of the calling process, a null pointer is returned.

Do not modify the value returned by the getenv() function. Because the pointer might be used by some other program. If it's necessary to manipulate the return value of getenv().

Non-Compliant Code Example

This non-compliant code example showing that modification of the string value returned by the function getenv().

int foo()
{
    char *env;
    env = getenv("TEST_ENV");
    env[0] = 'a';

    /*Do some more things*/

    return 0;
}

Compliant Code Solution

This is a compliant code solution. If it is necessary to modify the value the string returned by the function getenv(), then the programmer should make a local copy of that string value, and then modify the local copy of that string.

int foo()
{
    char *env;
    char *copy_of_env;

    env = getenv("TEST_ENV");
    copy_of_env = malloc( strlen(env) * sizeof(char) );
    /* Error handling */
    strcpy(copy_of_env, env);

    copy_of_env[0] = 'a';

    /*Do some more things*/

    return 0;
}

Risk Assessment