ENV01-A. Do not make assumptions about the size of an environment variable

Do not make any assumptions about the size of environment variables, as an adversary could have full control over the environment. Calculate the length of the strings yourself, and dynamically allocate memory for your copies (see STR31-C. Guarantee that storage for strings has sufficient space for character data and the NULL terminator).

Non-Compliant Code Example

This non-compliant code example copies the string returned by getenv() into a fixed size buffer. This can result in a buffer overflow.

char copy[16];
char *temp = getenv("TEST_ENV");
if (temp != NULL) {
  strcpy(copy, temp);
}

Compliant Solution

Use the strlen() function to calculate the size of the string and dynamically allocate the required space.

char *copy = NULL;
char *temp = getenv("TEST_ENV");
if (temp != NULL) {
  copy = (char *)malloc(strlen(temp) + 1);
  if (copy != NULL) {
    strcpy(copy, temp);
  }
  else {
    /* handle error condition */
  }
}

Risk Assessment

Making assumptions about the size of an environmental variable could result in a buffer overflow attack.

Automated Detection

Compass/ROSE can detect violations of the rule by using the same method as STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[ISO/IEC 9899-1999]] Section 7.20.4, "Communication with the environment"
[[Open Group 04]] Chapter 8, "Environment Variables"
[[Viega 03]] Section 3.6, "Using Environment Variables Securely"

ENV00-A. Do not store the pointer to the string returned by getenv()      10. Environment (ENV)       ENV02-A. Beware of multiple environment variables with the same effective name