A string literal is a sequence of zero or more multibyte characters enclosed in double quotes (for example, "xyz", for example). A wide string literal is the same, except prefixed by the letter 'L' (for example, L"xyz", for example).
At compile time, string literals are used to create an array of static storage duration of sufficient length to contain the character sequence and a null-termination character. It is unspecified whether these arrays are distinct. The behavior is undefined if a program attempts to modify string literals but frequently results in an access violation , as because string literals are typically stored in read-only memory. See also undefined behavior 30 of Annex J of C99.
...
As an array initializer, a string literal specifies the initial values of characters in an array, as well as the size of the array. (See guideline rule STR36-C. Do not specify the bound of a character array initialized with a string literal.) This code creates a copy of the string literal in the space allocated to the character array a. The string stored in a can be safely modified.
...
In this noncompliant example, the non-const char* result of the strchr() function is used to modify the object pointed to by pathname. Since the pointer points to a string literal, the effects of the modification are undefined and are likely to cause a signal, such as SIGSEGV, to be generated for the process if the object is stored in read-only memory.
...
A compliant solution avoids modifying a const object, even if it is possible to obtain a non-const pointer to such an object by calling a standard C library function, such as strrchr(). To reduce the risk of callers of get_dirname() passing constant objects to the function, the argument is declared to be a non-const pointer. While converting a string literal to non-const char* is permitted by the language, conforming compilers may could issue a diagnostic for such code. See also guideline recommendation EXP05-C. Do not cast away a const qualification.
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
CERT C++ Secure Coding Standard: STR30-CPP. Do not attempt to modify string literals
...
Wiki Markup
Bibliography
| Wiki Markup |
|---|
\[[Summit 1995|AA. Bibliography#Summit 95]\] comp.lang.c FAQ list - Question 1.32
\[[Plum 1991|AA. Bibliography#Plum 91]\] Topic 1.26, "strings - string literals" |
...