Page History

Null-terminated byte strings (NTBS) must contain a NULL-null termination character at or before the address of the last element of the array before they can be safely passed as arguments to standard string handling functions such as strcpy() or strlen(). This is because these functions, as well as other string handling functions defined by C99, depend on the existence of a NULL-null termination character to determine the length of a string. Similarly, NTBS must be NULLnull-terminated before iterating on a character array where the termination condition of the loop depends on the existence of a NULL-null termination character within the memory allocated for the string, as in the following example:

...

Failure to properly terminate NULLnull-terminated byte strings can result in buffer overflows and other undefined behavior.

...

One method to decrease memory usage in critical situations when all available memory has been exhausted is to use the realloc() function to half the size of message strings. The standard realloc() function has no concept of NULLnull-terminated byte strings. As a result, if realloc() is called to decrease the memory allocated for a NULLnull-terminated byte string, the NULL terminator may get null termination character may be truncated.

The following non-compliant code example fails to ensure that cur_msg is properly NULLnull-terminated:

char *cur_msg = NULL;
size_t cur_msg_size = 1024;

/* ... */

void lessen_memory_usage(void) {
  char *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size/2 + 1;
    temp = realloc(cur_msg, temp_size);
    if (temp == NULL) {
      /* Handle error condition */
    }
    cur_msg = temp;
    cur_msg_size = temp_size;
  }
}

/* ... */

Because realloc() does not guarantee that the string is properly NULLnull-terminated, any subsequent operation on cur_msg that assumes a NULLnull-termination character may result in undefined behavior.

...

In this compliant solution, the lessen_memory_usage() function ensures that the resulting string is always properly NULLnull-terminated.

char *cur_msg = NULL;
size_t cur_msg_size = 1024;

/* ... */

void lessen_memory_usage(void) {
  char *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size/2 + 1;
    temp = realloc(cur_msg, temp_size);
    if (temp == NULL) {
      /* Handle error condition */
    }
    cur_msg = temp;
    cur_msg_size = temp_size;
    cur_msg[cur_msg_size - 1] = '\0';  /* ensure string is NULLnull-terminated */
  }
}

/* ... */

...

• Presume that all char* parameters are NT(NULLnull-terminated). We must check that they are still NT at the end of the function. Additionally, the return value must be NT. We will also check that they are NT before being passed to another function.
• Any exceptions to the NT rule (functions that accept/return open strings) are specified separately. Given that this is C, the best option might be two hardcoded handling routines in the analysis. If the function either accepts an open string (not NULL null-terminated) or can return an open string, we can write some code to specify this. The analysis calls these handling routines to retrieve these specifications. Another option would be to utilize the preprocessor to write in-code specifications. However, this is not in the style of C programmers. Additionally, we can't add these specs to libraries that way. Given the environment, a separate specification, in C, is probably the best option.
• The integer range analysis tracks the lengths of char*s.
• We use a tuple lattice for the analysis. The lattice has 4 elements, bottom, NT (NULL terminating), O(open) and top(unknown).
• Use the specifications (or the default of NT) to set the initial lattice element for each char*.
• If we index into the string and set a character to '\0', move the string to NT. This only occurs if the index is less than the minimum size of the string. (The integer analysis must be aware of strlen and that it works properly only on NT strings.)
• Check that the parameters to all functions match the specifications. If not, cause an error.
• At the end of the function, Check that the return value and the parameters match the specification for the function. If not, cause an error.

...

This analysis also impacts STR03-A. Do not inadvertently truncate a NULL null-terminated byte string, STR07-A. Take care when calling realloc() on a NULL null-terminated byte string, and STR31-C. Guarantee that storage for strings has sufficient space for character data and the NULL terminatornull termination character.

Alternative Strategies

Testing

...

Risk Assessment

Failure to properly NULL null-terminate NULLnull-terminated byte strings can result in buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process or unintended information disclosure.

...