Problem - Kevin Tafuro

pointer or a different value altogether, if the environment is modified between the
time that you called getenv( ) and the time you use the pointer it returns.
There is a race condition here even after you call getenv() and before
you copy. Be careful to only manipulate the process environment from
a single thread at a time.
Never make any assumptions about the length or the contents of an environment
variable’s value. It can be extremely dangerous to simply copy the value into a statically
allocated buffer or even a dynamically allocated buffer that was not allocated
based on the actual size of the environment variable’s value. Always compute the size
of the environment variable’s value yourself, and dynamically allocate a buffer to
hold the copy.
Another problem with environment variables is that a malicious program could
manipulate the environment so that two or more environment variables with the
same name exist in your process’s environment. It is easy to detect this situation, but
it usually is not worth concerning yourself with it. Most, if not all, implementations
of getenv( ) will always return the first occurrence of an environment variable.
As a convenience, you can use the function spc_getenv( ), shown in the following
code, to obtain the value of an environment variable. It will return a copy of the environment
variable’s value allocated with strdup( ), which means that you will be
responsible for freeing the memory with free( ).
#include
#include
char *spc_getenv(const char *name) {
char *value;
if (!(value = getenv(name))) return 0;
return strdup(value);
}
Changing the value of an environment variable
The standard C runtime function putenv( ) is normally used to modify the value of
an environment variable. In some implementations, putenv( ) can even be used to
delete environment variables, but this behavior is nonstandard and therefore is not
portable. If you have sanitized the environment as described in Recipe 1.1, and particularly
if you use the code in that recipe, using putenv( ) could cause problems
because of the way that code manages the memory allocated to the environment. We
recommend that you avoid using the putenv( ) function altogether.
Another reason to avoid putenv( ) is that an attacker could have manipulated the
environment before spawning your process, in such a way that two or more environment
variables share the same name. You want to make certain that changing the
Using Environment Variables Securely | 93
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.