Problem - Kevin Tafuro

that uses an unsigned 32-bit value will wrap around every 49.71 days or so), the
result of your test is likely to be wrong!
In any case, you should be keeping track of wrap-arounds and taking appropriate
measures when they occur. Often, when you’re using a real-time clock, you can simply
use a clock with more precision. For example, recent x86 chips offer the RDTSC
instruction, which provides 64 bits of precision. (See Recipe 4.14.)
See Also
Recipe 4.14
3.6 Using Environment Variables Securely
Problem
You need to obtain the value of, alter the value of, or delete an environment variable.
Solution
A process inherits its environment variables from its parent process. While the parent
process most often will not do anything to tarnish the environment passed on to
its children, your program’s environment variables are still external inputs, and you
must therefore treat them as such.
The process that parents your own process could be a malicious process that has
manipulated the environment in an attempt to confuse your program and exploit
that confusion to nefarious ends. As much as possible, it is best to avoid depending
on the environment, but we recognize that is not always possible.
Discussion
In the following subsections, we’ll look at obtaining the value of an environment
variable as well as changing and deleting environment variables.
Obtaining the value of an environment variable
The normal means by which you obtain the value of an environment variable is by
calling getenv( ) with the name of the environment variable whose value is to be
retrieved. The problem with getenv( ) is that it simply returns a pointer into the environment,
rather than returning a copy of the environment variable’s value.
If you do not immediately make a copy of the value returned by getenv( ), but
instead store the pointer somewhere for later use, you could end up with a dangling
92 | Chapter 3: Input Validation
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.