Page History

Null-terminated byte strings (NTBS) must contain a null-termination character at or before the address of the last element of the array before they can be safely passed as arguments to standard string-handling functions, such as {{strcpy()}} or {{strlen()}}.  This is because these functions, as well as other string-handling functions defined by C99 \[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\], depend on the existence of a null-termination character to determine the length of a string.  Similarly, NTBS must be NULLnull terminated before iterating on a character array where the termination condition of the loop depends on the existence of a null-termination character within the memory allocated for the string, as in the following example:

...

The standard {{strncpy()}} function does not guarantee that the resulting string is NULLnull terminated \[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\]. If there is no null character in the first {{n}} characters of the {{source}} array, the result may not be NULLnull terminated.

In the first non-compliant code example, ntbs is NULL null terminated before the call to strncpy(). However, the subsequent execution of strncpy() may overwrite the null-termination character.

...

If the intent is to copy without truncation, this example copies the data and guarantee that the resulting null-terminated byte string is NULL null terminated. If the string cannot be copied, it is handled as an error condition.

...

This compliant solution also guarantees that the string is NULL null terminated.

char *source;
char a[NTBS_SIZE];
/* ... */
if (source) {
  errno_t err = strncpy_s(a, sizeof(a), source, 5);
  if (err != 0) {
    /* handle error */
  }
}
else {
  /* handle NULL string condition */
}

...

One method to decrease memory usage in critical situations when all available memory has been exhausted is to use the realloc() function to halve the size of message strings. The standard realloc() function has no concept of null-terminated byte strings. As a result, if realloc() is called to decrease the memory allocated for a null-terminated byte string, the NULL null-termination character may be truncated.

The following non-compliant code example fails to ensure that cur_msg is properly NULL null terminated:

char *cur_msg = NULL;
size_t cur_msg_size = 1024;

/* ... */

void lessen_memory_usage(void) {
  char *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size/2 + 1;
    temp = realloc(cur_msg, temp_size);
    if (temp == NULL) {
      /* Handle error condition */
    }
    cur_msg = temp;
    cur_msg_size = temp_size;
  }
}

/* ... */

Because realloc() does not guarantee that the string is properly NULL null terminated, any subsequent operation on cur_msg that assumes a null-termination character may result in undefined behavior.

...

In this compliant solution, the lessen_memory_usage() function ensures that the resulting string is always properly NULL null terminated.

char *cur_msg = NULL;
size_t cur_msg_size = 1024;

/* ... */

void lessen_memory_usage(void) {
  char *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size/2 + 1;
    temp = realloc(cur_msg, temp_size);
    if (temp == NULL) {
      /* Handle error condition */
    }
    cur_msg = temp;
    cur_msg_size = temp_size;

    /* ensure string is null-terminated */
    cur_msg[cur_msg_size - 1] = '\0';  
  }
}

/* ... */

Risk Assessment

Failure to properly NULL null terminate strings can result in buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process. Null-termination errors can also result in unintended information disclosure.

...