SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 107

changes.mady.by.user Will Snavely

Saved on

compared with

New Version 108

changes.mady.by.user Arthur Hicken

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: font

...

Truncating strings can lead to a loss of data.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

STR03-C

Medium

Probable

Medium

P8

L2

Automated Detection

Tool

Version

Checker

Description

CodeSonar
Include Page
CodeSonar_V
CodeSonar_V
MISC.MEM.NTERMNo Space For Null Terminator
Compass/ROSE

 

 



Could detect violations in the following manner: all calls to strncpy() and the other functions should be followed by an assignment of a terminating character to null-terminate the string

Klocwork
Include Page
Klocwork_V
Klocwork_V

NNTS.MIGHT
NNTS.MUST

 


LDRA tool suite
Include Page
LDRA_V
LDRA_V

115 S, 44 S

Partially implemented

Parasoft C/C++test
Include Page
c:
Parasoft_V
c:
Parasoft_V
BD-PB-OVERNZT
 

Polyspace Bug FinderR2016aBuffer overflow from incorrect string format specifier

String format specifier causes buffer argument of standard library functions to overflow

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

SEI CERT C++ Coding StandardVOID STR03-CPP. Do not inadvertently truncate a null-terminated character array
ISO/IEC TR 24772:2013String Termination [CJM]
MITRE CWECWE-170, Improper null termination
CWE-464, Addition of data structure sentinel

Bibliography

[Seacord 2013]Chapter 2, "Strings"

...


...