Page History

Null-terminated byte strings (NTBS) must be properly null-terminated contain a null-termination character at or before the address of the last element of the array before they can be safely passed as arguments to standard string handling functions such as strcpy() or strlen() that . This is because these functions, as well as other string handling functions defined by C99, depend on the existence of a null-termination character to determine to find the end length of the a string. Similarly, NTBS must be null-terminated before iterating on a character array where the termination condition of the loop depends on the existence of a null-termination character within the memory allocated for the string, as in the following example:

...

Non-Compliant Code Example

One method to decrease memory usage in critical situations when all available memory has been exhausted is to use the realloc() function to half the size of message strings. The standard realloc() function has no concept of null-terminated byte strings. As a result, if realloc() is called to decrease the memory allocated for a null-terminated byte string, the null terminator may get truncated.

The following non-compliant code example fails to ensure that cur_msg is properly null-terminated:

char *cur_msg = NULL;
size_t cur_msg_size = 1024;

/* ... */

void lessen_memory_usage(void) {
  char *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size/2 + 1;
    temp = realloc(cur_msg, temp_size);
    if (temp == NULL) {
      /* Handle error condition */
    }
    cur_msg = temp;
    cur_msg_size = temp_size;
  }
}

/* ... */

Because realloc() does not guarantee that the string is properly null-terminated, any subsequent operation on cur_msg that assumes a null-termination character may result in undefined behavior.

Compliant Solution

In this compliant solution, the lessen_memory_usage() function ensures that the resulting string is always properly null-terminated.

char *cur_msg = NULL;
size_t cur_msg_size = 1024;

/* ... */

void lessen_memory_usage(void) {
  char *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size/2 + 1;
    temp = realloc(cur_msg, temp_size);
    if (temp == NULL) {
      /* Handle error condition */
    }
    cur_msg = temp;
    cur_msg_size = temp_size;
    cur_msg[cur_msg_size - 1] = '\0';  /* ensure string is null-terminated */
  }
}

/* ... */

Mitigation Strategies

Static Analysis

...

Failure to properly null terminate null-terminated byte strings can result in buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process by an attackeror unintended information disclosure.

...

\[[ISO/IEC 9899-1999:TC2|AA. C References#ISO/IEC 9899-1999TC2]\] Section 7.1.1, "Definitions of terms," Section 7.20.3.4 "The realloc function," and Section 7.21, "String handling <string.h>"
\[[ISO/IEC TR 24731-2006|AA. C References#ISO/IEC TR 24731-2006]\] Section 6.7.1.4, "The strncpy_s function"
\[[Schwarz 05|AA. C References#Schwarz 05]\]
\[[Seacord 05|AA. C References#Seacord 05]\] Chapter 2, "Strings"
\[[Viega 05|AA. C References#Viega 05]\] Section 5.2.14, "Miscalculated null termination"