Page History

The C Standard allows an array variable to be declared both with a bound index and with an initialization literal. The initialization literal also implies an array size in the number of elements specified. For strings, the size specified by a string literal is the number of characters in the literal plus one for the terminating null character.

It is common for an array variable to be initialized by a string literal and declared with an explicit bound that matches the number of characters in the string literal. Subclause 6.7.9, paragraph 14, of the C Standard [ISO/IEC 9899:2011], says:

An array of character type may be initialized by a character string literal or UTF−8 string literal, optionally enclosed in braces. Successive bytes of the string literal (including the terminating null character if there is room or if the array is of unknown size) initialize the elements of the array.

However, if the string is intended to be used as a null-terminated byte string, then the array will have one too few characters to hold the string because it does not account for the terminating null character. Such a sequence of characters has limited utility and has the potential to cause vulnerabilities if a null-terminated byte string is assumed.

A better approach is to not specify the bound of a string initialized with a string literal because the compiler will automatically allocate sufficient space for the entire string literal, including the terminating null character. This rule is a specific exception to ARR02-C. Explicitly specify array bounds, even if implicitly defined by an initializer.

Noncompliant Code Example

This noncompliant

Do not initialize an array of characters using a string literal that contains more characters (including the terminating '\0', in the case of creating a null-terminated byte string) than the array can store.

Non-Compliant Code Example

This non-compliant code example initializes an array of characters using a string literal that defines one character more character (counting the terminating '\0') than the array can hold.:

const 
char s[3] = "abc";

The size of the array s is three3, although the size of the string literal is four. If the intention of this code is to initialize 4. Any subsequent use of the array as a null-terminated byte string , then any subsequent usage of the array is dangerous because the string the array represents does not have a terminating '\0'.

Compliant Solution

This compliant solution uses the appropriate size for initializing a null-terminated byte string from the string literal, by accounting for the space needed for the terminating '\0'.

char s[4] = "abc";

can result in a vulnerability, because s is not properly null-terminated. (See STR32-C. Do not pass a non-null-terminated character sequence to a library function that expects a string.)

Implementation Details

This code compiles with no warning with Visual Studio 2013 and GCC 4.8.1. It produces a three-character array with no terminating null character, as specified by the standard.

Compliant Solution

This compliant solution uses the array initialization method which does not explicitly describe the size. By omitting the size, the array will automatically be of appropriate length to store the full string literaldoes not specify the bound of a character array in the array declaration. If the array bound is omitted, the compiler allocates sufficient storage to store the entire string literal, including the terminating null character.

const 
char s[] = "abc";

This is the approach is preferred approach, because the result size of the expectation array can always can be obtained derived even if the size of the string literal is changedchanges.

Exceptions

STR09STR11-C-EX1: If the intention is to create only a character array of characters ( and not a null-terminated byte string) the space for the terminating null of a string literal can be omitted. For example, in the non-compliant code above, the assumption was that a null-terminated byte string was to be initialized. If the intention was , initializing to fit exactly without a null byte is allowed but not recommended. The preferred approach to create an array containing just the three characters 'a', 'b', and 'c', for example, is to declare each character literal as a separate element as follows:

char s[3] = { 'a', 'b',

...

 'c'

...

 }; /* NOT a string */

Also, you should make clear in comments or documentation if a character array is, in fact, not a null-terminated byte string.

STR11-C-EX2: If the character array must be larger than the string literal it is initialized with, you may explicitly specify an array bounds. This is particularly important if the array's contents might change during program execution.

#include <string.h>
 
void func(void) {
  char s[10] = "abc";
  strcpy(&s[3], "def");
}

Risk Assessment

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] 
\[[Seacord 05a|AA. C References#Seacord 05a]\] Chapter 2, "Strings"
[The Embedded C++ Programming Guide Lines|http://www.caravan.net/ec2plus/guide.html].  Version WP-GU-003. 6,Jan 1998 by the Embedded C++ Technical Committee A.8 Character array initialization

Related Guidelines

Bibliography

...

Image Added Image Added STR06-A. Do not assume that strtok() leaves the parse string unchanged      07. Characters and Strings (STR)       Image Modified