...
However, modifying the environment by any means may cause the environment memory to be reallocated , with the result that envp now references an incorrect location.
For example, when compiled with GCC version 3.4.6 and run on a 32-bit Intel GNU/Linux machine, the following code:
| Code Block |
|---|
extern char **environ;
/* ... */
int main(int argc, const char *argv[], const char *envp[]) {
printf("environ: %p\n", environ);
printf("envp: %p\n", envp);
setenv("MY_NEW_VAR", "new_value", 1);
puts("--Added MY_NEW_VAR--");
printf("environ: %p\n", environ);
printf("envp: %p\n", envp);
}
|
yields:
| Code Block |
|---|
% ./envp-environ environ: 0xbf8656ec envp: 0xbf8656ec --Added MY_NEW_VAR-- environ: 0x804a008 envp: 0xbf8656ec |
...
| Wiki Markup |
|---|
After a call to the POSIX {{setenv()}} function, or another function that modifies the environment, the {{envp}} pointer may no longer reference the environment. POSIX states that \[[Open Group 042004|AA. Bibliography#Open Group 04]\] |
...
This noncompliant code example accesses the envp pointer after calling _putenvs().
| Code Block | ||
|---|---|---|
| ||
int main(int argc, const char *argv[], const char *envp[]) {
size_t i;
if (_putenv_s("MY_NEW_VAR", "new_value") != 0) {
/* Handle error */
}
if (envp != NULL) {
for (i = 0; envp[i] != NULL; i++) {
if (puts(envp[i]) == EOF) {
/* Handle error */
}
}
}
return 0;
}
|
...
If you have a great deal of unsafe envp code, you can save time in your remediation by replacing.
| Code Block |
|---|
int main(int argc, char *argv[], char *envp[]) {
/* ... */
}
|
...
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
ENV31-C | low | probable | medium | P4 | L3 |
Automated Detection
Tool | Version | Checker | Description |
|---|---|---|---|
|
...
|
|
|
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Other Languages
Related Guidelines
CERT This rule appears in the C++ Secure Coding Standard as : ENV31-CPP. Do not rely on an environment pointer following an operation that may invalidate it.
...
Wiki Markup
Bibliography
| Wiki Markup |
|---|
\[[MSDN|AA. Bibliography#MSDN]\] [{{getenv, _wgetenv}}|http://msdn.microsoft.com/en-us/library/tehxacec.aspx], [{{_environ, _wenviron}}|http://msdn.microsoft.com/en-us/library/stxk41x1.aspx], [{{_putenv_s, _wputenv_s}}|http://msdn.microsoft.com/en-us/library/eyw7eyfw.aspx] \[[Open Group 042004|AA. Bibliography#Open Group 04]\] [{{setenv()}}|http://www.opengroup.org/onlinepubs/009695399/functions/setenv.html] |
...