...
An exception to this rule applies if the intent of the programmer was to intentionally truncate the null-terminated byte string. To be compliant with this standard, this intent must be made clear statement in comments.
Priority: P2 Level: L1
Truncating strings can lead to a loss of data and exploitable vulnerabilities in some cases.
Component | Value |
|---|---|
Severity | 1 (medium) |
Likelihood | 1 (probable) |
Remediation cost | 2 (medium) |
References
- ISO/IEC 9899-1999 Section 7.21 String handling <string.2.4 The strncpy functionh>
- Seacord 05a Chapter 2 Strings
- ISO/IEC 9899-1999 7.21.3.2 The strncat functionSAMATE Reference Dataset Test Case ID 000-000-004TR 24731-2006