@david_chisnall@infosec.exchange
2026-09-23 12:16 UTC
@ska@social.treehouse.systems
The worst one is environ because setenv actively mutates it and means that any pointer retrieved by getenv and any traversal of environ may dereference a dangling pointer in any POSIX-compliant implementation if setenv is every called, especially in a multithreaded program.
My general rule for setenv is never call it. The experts-only version is call it in main before calling any other function in another compilation unit.
Replies (0)
No replies.