Initial commit

9780596003944

 No newline at end of file

## Example files for the title:  

# Secure Programming Cookbook for C and C++, by John Viega

[![Secure Programming Cookbook for C and C++, by John Viega](http://akamaicovers.oreilly.com/images/9780596003944/cat.gif)](https://www.safaribooksonline.com/library/view/title/0596003943//)

The following applies to example files from material published by O’Reilly Media, Inc. Content from other publishers may include different rules of usage. Please refer to any additional usage rights explained in the actual example files or refer to the publisher’s website.

O'Reilly books are here to help you get your job done. In general, you may use the code in O'Reilly books in your programs and documentation. You do not need to contact us for permission unless you're reproducing a significant portion of the code. For example, writing a program that uses several chunks of code from our books does not require permission. Answering a question by citing our books and quoting example code does not require permission. On the other hand, selling or distributing a CD-ROM of examples from O'Reilly books does require permission. Incorporating a significant amount of example code from our books into your product's documentation does require permission.

We appreciate, but do not require, attribution. An attribution usually includes the title, author, publisher, and ISBN.

If you think your use of code examples falls outside fair use or the permission given here, feel free to contact us at <permissions@oreilly.com>.

Please note that the examples are not production code and have not been carefully testing. They are provided "as-is" and come with no warranty of any kind.

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <paths.h>

#include <limits.h>

extern char **environ;

/* These arrays are both NULL-terminated. */

static char *spc_restricted_environ[] = {

  "IFS= \t\n",

  "PATH=" _PATH_STDPATH,

  0

};

static char *spc_preserve_environ[] = {

  "TZ",

  0

};

void spc_sanitize_environment(int preservec, char **preservev) {

  int    i;

  char   **new_environ, *ptr, *value, *var;

  size_t arr_size = 1, arr_ptr = 0, len, new_size = 0;

  for (i = 0;  i >= 0 && (var = spc_restricted_environ[i]) != 0;  i++) {

    if (arr_size == SIZE_T_MAX || new_size > SIZE_T_MAX - strlen(var)) abort();

    new_size += strlen(var) + 1;

    arr_size++;

  }

  if (i < 0) abort();

  for (i = 0;  i >= 0 && (var = spc_preserve_environ[i]) != 0;  i++) {

    if (!(value = getenv(var))) continue;

    if (arr_size == SIZE_T_MAX || new_size > SIZE_T_MAX - strlen(var) - strlen(value) - 1) abort();

    new_size += strlen(var) + strlen(value) + 2; /* include the '=' */

    arr_size++;

  }

  if (i < 0) abort();

  if (preservec && preservev) {

    for (i = 0;  i < preservec && (var = preservev[i]) != 0;  i++) {

      if (!(value = getenv(var))) continue;

      if (arr_size == SIZE_T_MAX || new_size > SIZE_T_MAX - strlen(var) - strlen(value) - 1) abort();

      new_size += strlen(var) + strlen(value) + 2; /* include the '=' */

      arr_size++;

    }

  }

  if (new_size > SIZE_T_MAX - (arr_size * sizeof(char *)) + 1) abort();

  new_size += (arr_size * sizeof(char *));

  if (!(new_environ = (char **)malloc(new_size))) abort();

  new_environ[arr_size - 1] = 0;

  ptr = (char *)new_environ + (arr_size * sizeof(char *));

  for (i = 0;  (var = spc_restricted_environ[i]) != 0;  i++) {

    new_environ[arr_ptr++] = ptr;

    len = strlen(var);

    memcpy(ptr, var, len + 1);

    ptr += len + 1;

  }

  for (i = 0;  (var = spc_preserve_environ[i]) != 0;  i++) {

    if (!(value = getenv(var))) continue;

    new_environ[arr_ptr++] = ptr;

    len = strlen(var);

    memcpy(ptr, var, len);

    *(ptr + len + 1) = '=';

    memcpy(ptr + len + 2, value, strlen(value) + 1);

    ptr += len + strlen(value) + 2; /* include the '=' */

  }

  if (preservec && preservev) {

    for (i = 0;  i < preservec && (var = preservev[i]) != 0;  i++) {

      if (!(value = getenv(var))) continue;

      new_environ[arr_ptr++] = ptr;

      len = strlen(var);

      memcpy(ptr, var, len);

      *(ptr + len + 1) = '=';

      memcpy(ptr + len + 2, value, strlen(value) + 1);

      ptr += len + strlen(value) + 2; /* include the '=' */

    }

  }

  environ = new_environ;

}