| Wiki Markup |
|---|
Copying data to a buffer that is not large enough to hold that data results in a buffer overflow. While not limited to nullNULL-terminated byte strings (NTBS), this type of error often occurs when manipulating NTBS data. To prevent such errors, limit copies either through truncation (although consult \[[STR03-A. Do not inadvertently truncate a nullNULL-terminated byte string]\] for problems that may cause) or, preferably, ensure that the destination is of sufficient size to hold the character data to be copied and the nullNULL-termination character. |
Non-Compliant Code Example (off-by-1 error)
| Wiki Markup |
|---|
This non-compliant code example demonstrates what is commonly referred to as an _off-by-one_ error \[[Dowd 06|AA. C References#Dowd 06]\]. The loop copies data from {{src}} to {{dest}}. However, the nullNULL terminator may incorrectly be written one byte past the end of {{dest}}. The flaw exists because the loop does not account for the nullNULL-termination character that must be appended to {{dest}}. |
...
To correct this example, the terminating condition of the loop must be modified to account for the nullNULL-termination character that is appended to dest.
...
| Wiki Markup |
|---|
Command-line arguments are passed to {{main()}} as pointers to nullNULL-terminated byte strings in the array members {{argv\[0\]}} through {{argv\[argc-1\]}}. If the value of {{argc}} is greater than zero, the string pointed to by {{argv\[0\]}} represents the program name. If the value of {{argc}} is greater than one, the strings pointed to by {{argv\[1\]}} through {{argv\[argc-1\]}} represent the program parameters. |
...
Remember to add a byte to accommodate the nullNULL-terminated byte string.
Non-Compliant Code Example ( argv TOCTOU)
...
| Code Block | ||
|---|---|---|
| ||
char *copy_string(char const char *src) { /* ... */ char *dest = (char *)malloc(strlen(src)+1); if (dest != NULL) { strcpy(dest, src); } else { /* Couldn't get the memory - recover */ } /* ... */ } |
...
Environmental variables are loaded into process memory when the program is loaded. As a result, the length of these nullNULL-terminated byte strings can be determined by calling the strlen() function and the resulting length used to allocate adequate dynamic memory:
...
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
STR31-C | 3 ( high ) 3 ( | likely ) | 2 ( medium ) | P18 | L1 |
Automated Detection
The LDRA tool suite V 7.6.0 is able to detect violations of this rule.
...