Page History

Many library functions accept a string or wide string argument with the constraint that the string they receive is properly null-terminated. Passing a character sequence or wide character sequence that is not null-terminated to such a function can result in accessing memory that is outside the bounds of the object.   Do not pass a character sequence or wide character sequence that is not null-terminated to a library function that expects a string or wide string argument. 

...

This code example is noncompliant because the character sequence c_str will not be null-terminated when passed as an argument to printf(). (see See STR11-C. Do not specify the bound of a character array initialized with a string literal): on how to properly initialize character arrays.)

#include <stdio.h>
 
void func(void) {
  char c_str[3] = "abc";
  printf("%s\n", c_str);
}

...

#include <stdlib.h>
#include <wchar.h>
 
wchar_t *cur_msg = NULL;
size_t cur_msg_size = 1024;
size_t cur_msg_len = 0;

void lessen_memory_usage(void) {
  wchar_t *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size / 2 + 1;
    temp = realloc(cur_msg, temp_size * sizeof(wchar_t));
    //* temp &and cur_msg mightmay no notlonger be null-terminated */
    if (temp == NULL) {
      /* Handle error */
    }

    cur_msg = temp;
    cur_msg_size = temp_size;
    cur_msg_len = wcslen(cur_msg); 
  }
}

...

#include <stdlib.h>
#include <wchar.h>
 
wchar_t *cur_msg = NULL;
size_t cur_msg_size = 1024;
size_t cur_msg_len = 0;

void lessen_memory_usage(void) {
  wchar_t *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size / 2 + 1;
    temp = realloc(cur_msg, temp_size * sizeof(wchar_t));
    //* temp &and cur_msg mightmay no notlonger be null-terminated */
    if (temp == NULL) {
      /* Handle error */
    }

    cur_msg = temp;
    //* Properly null-terminate cur_msg now properly null-terminated*/
    cur_msg[temp_size - 1] = L'\0'; 
    cur_msg_size = temp_size;
    cur_msg_len = wcslen(cur_msg); 
  }
}

Noncompliant Code Example (strncpy())

While Although the strncpy() function takes a string as input, it does not guarantee that the resulting value is still null-terminated. In the following noncompliant code example, if no null character is contained in the first n characters of the source array, the result will not be null-terminated. Passing a non-null-terminated character sequence to strlen() results in is undefined behavior:.

#include <string.h>
 
enum { STR_SIZE = 32 };
 
size_t func(const char *source) {
  char c_str[STR_SIZE];
  size_t ret = 0;

  if (source) {
    c_str[sizeof(c_str) - 1] = '\0';
    strncpy(c_str, source, sizeof(c_str));
  return  ret = strlen(c_str);
  } else {
    /* Handle null pointer */
  }
  return ret;
}

Compliant Solution (Truncation)

The correct solution depends on This compliant solution is correct if the programmer's intent . If the intent is to truncate a string, this solution can be usedthe string:

#include <string.h>
 
enum { STR_SIZE = 32 };
 
size_t func(const char *source) {
  char c_str[STR_SIZE];
  size_t ret = 0;

  if (source) {
    strncpy(c_str, source, sizeof(c_str) - 1);
    c_str[sizeof(c_str) - 1] = '\0';
    ret return= strlen(c_str);
  } else {
    /* Handle null pointer */
  }
  return ret;
}

Compliant Solution (

...

Truncation, strncpy_s())

The C Standard, Annex K strncpy_s() function can also be used to copy with truncation. The strncpy_s() function copies up to n characters from the source array to a destination array. If no null character was copied from the source array, then the nth position in the destination array is set to a null character, guaranteeing that the resulting string is null-terminated.

#define __STDC_WANT_LIB_EXT1__ 1
#include <string.h>
 
enum { STR_SIZE = 32 };
 
size_t func(const char *source) {
  char c_str[STR_SIZE];
  size_t ret = 0;

  if (source) {
     if (strlen(source) <errno_t err = strncpy_s(
      c_str, sizeof(c_str), source, strnlen(source, sizeof(c_str))
    );
    if (err != 0) {
      strcpy(c_str, source);/* Handle error */
    } else {
      /*ret Handle string-too-large */= strnlen(c_str, sizeof(c_str));
    }
  } else {
     /* Handle null pointer */
  }
  return strlen(c_str)ret;
}

Compliant Solution (

...

Copy without Truncation)

If the programmer's intent is to copy without truncation, this compliant solution copies the data and guarantees that the resulting array is null-terminated. If the string cannot be copied, it is handled as an error condition.The C11 Annex K strncpy_s() function copies up to n characters from the source array to a destination array. If no null character was copied from the source array, then the nth position in the destination array is set to a null character, guaranteeing that the resulting string is null-terminated.

#define __STDC_WANT_LIB_EXT1__ 1
#include <string.h>
   
enum { STR_SIZE = 32 };
   
size_t func(const char *source) {
  char ac_str[STR_SIZE];
  size_t ret = 0;

  if (source) {
    errno_t err = strncpy_s(a, sizeof(a), source, 5if (strnlen(source, sizeof(c_str)) < sizeof(c_str)) {
      strcpy(c_str, source);
    if  (errret != 0) strlen(c_str);
    } else {
      /* Handle errorstring-too-large */
    }
  } else {
    /* Handle null pointer */
  }
  return strlen_s(s, sizeof(a));
}ret;
}

Note that this code is not bulletproof. It gracefully handles the case where source  is NULL, when it is a valid string, and when source is not null-terminated, but at least the first 32 bytes are valid. However, in cases where source is not NULL, but points to invalid memory, or any of the first 32 bytes are invalid memory, the first call to strnlen() will access this invalid memory, and the resulting behavior is undefined. Unfortunately, standard C provides no way to prevent or even detect this condition without some external knowledge about the memory source points to.

Risk Assessment

Failure to properly null-terminate a character sequence that is passed to a library function that expects a string can result in buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process. Null-termination errors can also result in unintended information disclosure.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-119 and STR32-C

Independent( ARR30-C, ARR38-C, ARR32-C, INT30-C, INT31-C, EXP39-C, EXP33-C, FIO37-C) STR31-C = Subset( Union( ARR30-C, ARR38-C)) STR32-C = Subset( ARR38-C)

CWE-119 = Union( STR32-C, list) where list =

• Out-of-bounds reads or writes that do not involve non-null-terminated byte strings.

CWE-125 and STR32-C

Independent( ARR30-C, ARR38-C, EXP39-C, INT30-C) STR31-C = Subset( Union( ARR30-C, ARR38-C)) STR32-C = Subset( ARR38-C)

CWE-125 = Union( STR32-C, list) where list =

• Out-of-bounds reads that do not involve non-null-terminated byte strings.

CWE-123 and STR32-C

Independent(ARR30-C, ARR38-C) STR31-C = Subset( Union( ARR30-C, ARR38-C)) STR32-C = Subset( ARR38-C)

Intersection( CWE-123, STR32-C) =

• Buffer overflow from passing a non-null-terminated byte string to a standard C library copying function that expects null termination, and that overwrites an (unrelated) pointer

STR32-C - CWE-123 =

• Buffer overflow from passing a non-null-terminated byte string to a standard C library copying function that expects null termination, but it does not overwrite an (unrelated) pointer

CWE-123 – STR31-C =

• Arbitrary writes that do not involve standard C library copying functions, such as strcpy()

Bibliography

...

...

Image Modified Image Modified Image Modified