...
The managed string library also provides a mechanism for dealing with data sanitization by (optionally) checking that all characters in a string belong to a predefined set of "safe" characters.
Priority: P6 Level: L1
String handling functions defined in C99 Section 7.21 and elsewhere are susceptible to common programming errors that can lead to serious, exploitable vulnerabilities. Managed strings, when used properly, can eliminate many of these errors--particularly in new development.
Component | Value |
|---|---|
Severity | 3 (medium) |
Likelihood | 2 (probable) |
Remediation cost | 1 (high) |
References
- Burch 06
- Managed String Library http://www.cert.org/secure-coding/managedstring.html
- ISO/IEC 9899-1999 Section 7.21 String handling <string.h>
- Seacord 05a Chapter 2 Strings