ENV01-C. Do not make assumptions about the size of an environment variable

Do not make any assumptions about the size of environment variables, because an adversary might have full control over the environment. If the environment variable needs to be stored, then the length of the associated string should be calculated, and the storage dynamically allocated (see STR31-C. Guarantee that storage for strings has sufficient space for character data and the NULL terminator).

Noncompliant Code Example

This noncompliant code example copies the string returned by getenv() into a fixed-size buffer.

void f() {
  char path[PATH_MAX]; /* requires PATH_MAX to be defined */
  strcpy(path, getenv("PATH"));
  /* use path */
}

Even if your platform assumes that $PATH is defined, defines PATH_MAX, and enforces that paths not have more than PATH_MAX characters, there is still no requirement that the $PATH environment variable have less than PATH_MAX chars. And if it has more than PATH_MAX chars, a buffer overflow will result. Also, if $PATH is not defined, then strcpy() will attempt to dereference a null pointer.

Compliant Solution

In the following compliant solution, the strlen() function is used to calculate the size of the string, and the required space is dynamically allocated.

void f() {
  char *copy = NULL;
  /* avoid assuming $PATH is defined or has limited length */
  const char *temp = getenv("PATH");
  if (temp != NULL) {
    path = (char*) malloc(strlen(temp) + 1);
    if (copy == NULL) {
      /* Handle error condition */
    } else {
      strcpy(path, temp);
    }
    /* use path */
  }
}

Risk Assessment

Making assumptions about the size of an environmental variable can result in a buffer overflow.

Automated Detection

Compass/ROSE can detect violations of the rule by using the same method as STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C++ Secure Coding Standard as ENV01-CPP. Do not make assumptions about the size of an environment variable.

References

[[ISO/IEC 9899:1999]] Section 7.20.4, "Communication with the environment"
[[MITRE 07]] CWE ID 119, "Failure to Constrain Operations within the Bounds of an Allocated Memory Buffer"
[[Open Group 04]] Chapter 8, "Environment Variables"
[[Viega 03]] Section 3.6, "Using Environment Variables Securely"

ENV00-C. Do not store the pointer to the string returned by getenv()      10. Environment (ENV)