Page History

Null-terminated byte strings are, by definition, Many library functions accept a string or wide string argument with the constraint that the string they receive is properly null-terminated. String operations cannot determine the length or end of strings that are not properly null-terminated, which can consequently result in buffer overflows and other undefined behavior.

...

Passing a character sequence or wide character sequence that is not null-terminated to such a function can result in accessing memory that is outside the bounds of the object. Do not pass a character sequence or wide character sequence that is not null-terminated to a library function that expects a string or wide string argument. 

Noncompliant Code Example

This code example is noncompliant because the character sequence c_str will not be null-terminated when passed as an argument to printf(). (See STR11-C. Do not specify the bound of a character array initialized with a string literal on how to properly initialize character arrays.)

#include <stdio.h>
 
void func(void) {
  char c_str[3] = "abc";
  printf("%s\n", c_str);
}

Compliant Solution

This compliant solution does not specify the bound of the character array in the array declaration. If the array bound is omitted, the compiler allocates sufficient storage to store the entire string literal, including the terminating null character.

#include <stdio.h>
 
void func(void) {
  char c_str[] = "abc";
  printf("%s\n", c_str);
}

Noncompliant Code Example

This code example is noncompliant because the wide character sequence cur_msg will not be null-terminated when passed to wcslen(). This will occur if lessen_memory_usage() is invoked while cur_msg_size still has its initial value of 1024.

#include <stdlib.h>
#include <wchar.h>
 
wchar_t *cur_msg = NULL;
size_t cur_msg_size = 1024;
size_t cur_msg_len = 0;

void lessen_memory_usage(void) {
  wchar_t *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size / 2 + 1;
    temp = realloc(cur_msg, temp_size * sizeof(wchar_t));
    /* temp &and cur_msg may no longer be null-terminated */
    if (temp == NULL) {
      /* Handle error */
    }

    cur_msg = temp;
    cur_msg_size = temp_size;
    cur_msg_len = wcslen(cur_msg); 
  }
}

Compliant Solution

In this compliant solution, cur_msg will always be null-terminated when passed to wcslen():

#include <stdlib.h>
#include <wchar.h>
 
wchar_t *cur_msg = NULL;
size_t cur_msg_size = 1024;
size_t cur_msg_len = 0;

void lessen_memory_usage(void) {
  wchar_t *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size / 2 + 1;
    temp = realloc(cur_msg, temp_size * sizeof(wchar_t));
    /* temp and cur_msg may no longer be null-terminated */
    if (temp == NULL) {
      /* Handle error */
    }

    cur_msg = temp;
    /* Properly null-terminate cur_msg */
    cur_msg[temp_size - 1] = L'\0'; 
    cur_msg_size = temp_size;
    cur_msg_len = wcslen(cur_msg); 
  }
}

Noncompliant Code Example (strncpy())

Although the strncpy() function takes a string as input, it does not guarantee that the resulting value is still null-terminated. In the following noncompliant code example, if no null character is contained in the first n characters of the source array, the result will not be null-terminated. Passing a non-null-terminated character sequence to strlen() is undefined behavior.

#include <string.h>
 
enum { STR_SIZE = 32 };
 
size_t func(const char *source) {
  char c_str[STR_SIZE];
  size_t ret = 0;

  if (source) {
    c_str[sizeof(c_str) - 1] = '\0';
    strncpy(c_str, source, sizeof(c_str));
    ret = strlen(c_str);
  } else {
    /* Handle null pointer */
  }
  return ret;
}

Compliant Solution (Truncation)

This compliant solution is correct if the programmer's intent is to truncate the string:

#include <string.h>
 
enum { STR_SIZE = 32 };
 
size_t func(const char *source) {
  char c_str[STR_SIZE];
  size_t ret = 0;

  if (source) {
    strncpy(c_str, source, sizeof(c_str) - 1);
    c_str[sizeof(c_str) - 1] = '\0';
    ret = strlen(c_str);
  } else {
    /* Handle null pointer */
  }
  return ret;
}

Compliant Solution (Truncation, strncpy_s())

The C Standard, Annex K strncpy_s() function can also be used to copy with truncation. The strncpy_s() function copies up to n characters from the source array to a destination array. If no null character was copied from the source array, then the nth position in the destination array is set to a null character, guaranteeing that the resulting string is null-terminated.

#define __STDC_WANT_LIB_EXT1__ 1
#include <string.h>

enum { STR_SIZE = 32 };

size_t func(const char *source) {
  char c_str[STR_SIZE];
  size_t ret = 0;

  if (source) {
    errno_t err = strncpy_s(
      c_str, sizeof(c_str), source, strnlen(source, sizeof(c_str))
    );
    if (err != 0) {
      /* Handle error */
    } else {
      ret = strnlen(c_str, sizeof(c_str));
    }
  } else {
     /* Handle null pointer */
  }
  return ret;
}

Compliant Solution (Copy without Truncation)

If the programmer's intent is to copy without truncation, this compliant solution copies the data and guarantees that the resulting array is null-terminated. If the string cannot be copied, it is handled as an error condition.

#include <string.h>
 
enum { STR_SIZE = 32 };
 
size_t func(const char *source) {
  char c_str[STR_SIZE];
  size_t ret = 0;

  if (source) {
    if (strnlen(source, sizeof(c_str)) < sizeof(c_str)) {
      strcpy(c_str, source);
      ret = strlen(c_str);
    } else {
      /* Handle string-too-large */
    }
  } else {
    /* Handle null pointer */
  }
  return ret;
}

Note that this code is not bulletproof. It gracefully handles the case where source  is NULL, when it is a valid string, and when source is not null-terminated, but at least the first 32 bytes are valid. However, in cases where source is not NULL, but points to invalid memory, or any of the first 32 bytes are invalid memory, the first call to strnlen() will access this invalid memory, and the resulting behavior is undefined. Unfortunately, standard C provides no way to prevent or even detect this condition without some external knowledge about the memory source points to.

Risk Assessment

Failure to properly null-terminate a character sequence that is passed to a library function that expects a string can result in buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process. Null-termination errors can also result in unintended information disclosure.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-119 and STR32-C

Independent( ARR30-C, ARR38-C, ARR32-C, INT30-C, INT31-C, EXP39-C, EXP33-C, FIO37-C) STR31-C = Subset( Union( ARR30-C, ARR38-C)) STR32-C = Subset( ARR38-C)

CWE-119 = Union( STR32-C, list) where list =

• Out-of-bounds reads or writes that do not involve non-null-terminated byte strings.

CWE-125 and STR32-C

Independent( ARR30-C, ARR38-C, EXP39-C, INT30-C) STR31-C = Subset( Union( ARR30-C, ARR38-C)) STR32-C = Subset( ARR38-C)

CWE-125 = Union( STR32-C, list) where list =

• Out-of-bounds reads that do not involve non-null-terminated byte strings.

CWE-123 and STR32-C

Independent(ARR30-C, ARR38-C) STR31-C = Subset( Union( ARR30-C, ARR38-C)) STR32-C = Subset( ARR38-C)

Intersection( CWE-123, STR32-C) =

• Buffer overflow from passing a non-null-terminated byte string to a standard C library copying function that expects null termination, and that overwrites an (unrelated) pointer

STR32-C - CWE-123 =

• Buffer overflow from passing a non-null-terminated byte string to a standard C library copying function that expects null termination, but it does not overwrite an (unrelated) pointer

CWE-123 – STR31-C =

• Arbitrary writes that do not involve standard C library copying functions, such as strcpy()

Bibliography

...

Image Added Image Added Image Added

...

Exception

An exception to this rule applies if the intent of the programmer is to convert a null-terminated byte string to a character array.  To be compliant with this standard, this intent must be clearly stated in comments.

Risk Assessment

Failure to properly null terminate null-terminated byte strings can result in buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process by an attacker.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Mitigation Strategies

(Section under construction by Ciera. Just wanted to get some current notes down here before I clean it up.)

Static Analysis

A local analysis should work fine here. We will assume that all byte string parameters to a method are required to be null terminated and are guaranteed to be null terminated after the function.

In the case where it is not required or not guaranteed, we will have to create a separate specification. Given that this is C, the best option might be two hardcoded handling routines in the analysis. If the function either accepts an open string (not null terminated) or can return an open string, we can write some code to specify this. The analysis calls these handling routines to retrieve these specifications.

Another option would be to utilize the preprocessor. However, I don't think that is in the style of C programmers. Additionally, we can't add these specs to libraries that way. Given the environment, a separate specification, in C, is probably the best option.

We also need to assume that there is a string length analysis.

Once we have this information, we can do a local flow analysis. The lattice has 4 elements, bottom, NT(null terminating), O(open) and top(unknown). If we index into the string and set a character to '\0', move the string to NT. The hard part here is knowing the size of the string. We need to make sure the index is not past the existing size of the string, measured either as strlen() on an NT char* or sizeof().

Check that we do not pass in O or M strings to methods that require NT. Also check that we meet our own out specifications.

There is a question of what to do about character arrays. One option is to assume that char\[\] is open, and using it as a char\* means that we first must make it null terminating. This could get annoying for developers very quickly. I think it's better to treat char\[\] as char*, that is, we assume NT and check for it. If the exception case does occur, it will have to be specified.

This analysis also impacts STR03-A, STR07-A, and STR31-C.

Combined attack (SA/DA/T)

Static analysis to generate test cases, dynamic analysis instruments the code that the test cases run on. Will have slightly different tradeoffs to SA. Good if we don't know the codebase well enough to create the handlers for non-NT functions. More work up front to create this kind of analysis, but reusable to many codebases. Provides the breadth of static analysis, the preciseness of dynamic analysis, and the repeatability of testing. Will have to think through this algorithm more carefully.

Rejected Strategies

Testing

It would probably be prohibitively expensive to come up with the test cases by hand.

Dynamic Analysis

It seems the analysis won't be very different from the static analysis, in which case, we should just do this statically.

Inspection

An inspection would essentially grep for known problem functions and inspect the usage. Obviously, this is extremely costly, as there would be a lot of false positives, and this does not scale well. There may also be many false negatives. Say Dev A inspects a function that returns an open string. Dev A considers it ok and documents it as such, perhaps this is one of the exception cases. Dev B might be inspecting another part of the code and might not realize that Dev A allowed an open string. It might be documented, but this is not very reliable. This might lead to a false sense of confidence that since the developers hand inspected every case that the code is fine, when in fact, a miscommunication can cause a defect.

References

Wiki Markup\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.1.1, "Definitions of terms," and Section 7.21, "String handling <string.h>" \[[Seacord 05|AA. C References#Seacord 05]\] Chapter 2, "Strings" \[[ISO/IEC TR 24731-2006|AA. C References#ISO/IEC TR 24731-2006]\] Section 6.7.1.4, "The strncpy_s function" \[[Viega 05|AA. C References#Viega 05]\] Section 5.2.14, "Miscalculated null termination"