Page History

...

It is common for an array variable to be initialized by a string literal and declared with an explicit bound that matches the number of characters in the string literal. Section  Subclause 6.7.9, paragraph 14, of the C Standard [ISO/IEC 9899:2011], says:

...

Implementation Details

This code produces a compilation error in MSVC 2008. It compiles code compiles with no warning in Visual Studio 2012 and GCC 4.3.3. It produces a three-character array with no terminating null character, as specified by the standard.

...

char s[3] = { 'a', 'b', 'c' }; /* NOT a string. */

Also, you should make clear in comments or documentation if a character array is, in fact, not a null-terminated byte string.

...

#include <string.h>
 
void func(void) {
  char s[10] = "abc";
  strcpy(&s[3], "def");
}

Risk Assessment

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

...

...