Use of putenv() with a pointer to a stack variable
ID |
c.memory_management.putenv_stack_var |
Severity |
low |
Resource |
Memory Management |
Language |
C / C++ |
Description
The software calls putenv() with a variable that has a short lifetime, such as a pointer to an automatic variable allocated on the stack. The correct behavior is to call putenv() with a static/global string.
Rationale
The software calls putenv() with a variable that has a short lifetime, such as a pointer to an automatic variable allocated on the stack. The correct behavior is to call putenv() with a static/global string.
The following code illustrates a vulnerable pattern detected by this rule:
int putName_bad()
{
char name[STR_MAX];
fillInName(name);
// VULNERABLE: Use of putenv() with a pointer to a stack variable
putenv(name);
return 0;
}