...
Finally, subclause 7.26.6.3, paragraph 4 [ISO/IEC 9899:2024], states
The
strerrorfunction returns a pointer to the string, the contents of which are locale-specific. The array pointed to shall not be modified by the program. The behavior is undefined if the returned value is used after a subsequent call to thestrerrorfunction, or after the thread which called the function to obtain the returned value has exited.
...
Modifying the object pointed to by the return value of getenv(), setlocale(), localeconv(), asctime(), or strerror() is undefined behavior. Even if the modification succeeds, the modified object can be overwritten by a subsequent call to the same function.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
ENV30-C | Low | Probable | No | MediumNo | P4P2 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| stdlib-const-pointer-assign | Partially checked | ||||||
| Axivion Bauhaus Suite |
| CertC-ENV30 | |||||||
| CodeSonar |
| BADFUNC.GETENV | Use of getenv | ||||||
| Compass/ROSE | Can detect violations of this rule. In particular, it ensures that the result of | ||||||||
| Cppcheck Premium |
| premium-cert-env30-cFully implemented | |||||||
| Helix QAC |
| C1492, C1493, C1494 DF4751, DF4752, DF4753 | |||||||
| Klocwork |
| MISRA.STDLIB.CTYPE.RANGE.2012_AMD1 | |||||||
| LDRA tool suite |
| 107 D | Partially Implemented | ||||||
| Parasoft C/C++test |
| CERT_C-ENV30-a | The pointers returned by the Standard Library functions 'localeconv', 'getenv', 'setlocale' or, 'strerror' shall only be used as if they have pointer to const-qualified type | ||||||
| Polyspace Bug Finder |
| Checks for modification of internal buffer returned from nonreentrant standard function (rule fully covered) | |||||||
| PVS-Studio |
| V675 | |||||||
| RuleChecker |
| stdlib-const-pointer-assign | Partially checked | ||||||
| Security Reviewer - Static Reviewer |
| C27 | Fully implemented |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...