Page History

...

It is common for an array variable to be initialized by a string literal and declared with an explicit bound that matches the number of characters in the string literal. C99 Section 6.7.8 "Initialization", paragraph 14, says:

An array of character type may be initialized by a character string literal, optionally enclosed in braces. Successive characters of the character string literal (including the terminating null character if there is room or if the array is of unknown size) initialize the elements of the array.

However, if the string is intended to be used as a null-terminated byte string, then the array will have This is one too few characters to hold the string, because it does not account for the terminating null character. Such a sequence of characters has limited utility and has the potential to cause vulnerabilities if a null-terminated byte string is assumed.

A better approach is to not specify the bound of a string initialized with a string literal, as the compiler will automatically allocate sufficient space for the entire string literal, including the terminating null character. This rule is a specific exception to ARR02-C. Explicitly specify array bounds, even if implicitly defined by an initializer.Initializing a character array using a string literal to fit exactly without a null byte is not allowed in C++.

Noncompliant Code Example

...

The size of the array s is three, although the size of the string literal is four. Any subsequent use of the array as a null-terminated byte string can result in a vulnerability, because s is not properly null-terminated (see STR32-C. Null-terminate byte strings as required).

Implementation Details

This code produces a compilation error in MSVC 2008.

This code compiles with no warning in GCC 4.3.3. It produces a 3-character array with no terminating null character, as specified by the standard.

Compliant Solution

This compliant solution does not specify the bound of a character array in the array declaration. If the array bound is omitted, the compiler will allocate sufficient storage to store the entire string literal, including the terminating null character.

...

Also, you should make clear in comments or documentation if a character array is, in fact, not a null-terminated byte string.

STR36-EX2: If the char array must be larger than the string being initialized might change in the futureliteral it is initialized with, you may explicitly specify an array bounds. This is particularly important if the array might hold strings longer than the initialization string's contents might change in the future.

char s[10] = "abc";
strcpy(&s[3], "def");

...