printf and getenv
Ubuntu 10.04, C, gcc, x86 Intel proc:

When trying to print the address of an environmental variable using printf, the address printed is not correct in this toy program (this is a consciously backward version in which I tried to isolate the source of the problem by saving the address value on the heap, not using a pointer directly as I read it can be overwritten, and using a pointer straight up produced the same issue):

    #include <stdio.h>
    #include <stdlib.h>

    int main(){

        const char* d = getenv("TEST");
        unsigned i = (unsigned*) malloc(sizeof(unsigned));
        i = (unsigned*) d;

        printf("%s at location 0x%8d.\n", "TEST", i);

}

If I change the program to not print TEST's address, but TEST as a string (its value), no problem.

However, the address returned is not the address at which the environmental variable is actually located before entering the print sub-routine; and which, by the above set-up, should be printed. Using main's disassembly and TEST's address in the eax register, I am referred to the proper location of the TEST variable, which is a little further down than main's stack frame at about 0xbffffiii on my system (i any hex value). The address value printed is on the order of 0xbfeiiiii.

I don't understand. Is this a security precaution to prevent environmental variables from being overwritten (eg, to smash the stack)? If yes, does the compiler really keep track of transferring the address as I do above, and silently adjusting its value? 

Or am I missing something? (probably)

Many thanks.
printf and getenv
===

Ubuntu 10.04, C, gcc, x86 Intel proc:

When trying to print the address of an environmental variable using printf, the address printed is not correct in this toy program (this is a consciously backward version in which I tried to isolate the source of the problem by saving the address value on the heap, not using a pointer directly as I read it can be overwritten, and using a pointer straight up produced the same issue):

    #include <stdio.h>
    #include <stdlib.h>

    int main(){

        const char* d = getenv("TEST");
        unsigned i = (unsigned*) malloc(sizeof(unsigned));
        i = (unsigned*) d;

        printf("%s at location 0x%8d.\n", "TEST", i);

}

If I change the program to not print TEST's address, but TEST as a string (its value), no problem.

However, the address returned is not the address at which the environmental variable is actually located before entering the print sub-routine; and which, by the above set-up, should be printed. Using main's disassembly and TEST's address in the eax register, I am referred to the proper location of the TEST variable, which is a little further down than main's stack frame at about 0xbffffiii on my system (i any hex value). The address value printed is on the order of 0xbfeiiiii.

I don't understand. Is this a security precaution to prevent environmental variables from being overwritten (eg, to smash the stack)? If yes, does the compiler really keep track of transferring the address as I do above, and silently adjusting its value? 

Or am I missing something? (probably)

Many thanks.