Page History

Alternative functions that limit the number of bytes copied are often recommended to mitigate buffer overflow vulnerabilities. For exampleExamples include

• strncpy() instead of strcpy()
• strncat() instead of strcat()
• fgets() instead of gets()
• snprintf() instead of sprintf()

These functions truncate strings that exceed the specified limits. Additionally, some functions, such as strncpy(), do not guarantee that the resulting string character sequence is null-terminated. (see See STR32-C. Null-terminate byte strings as required).Do not pass a non-null-terminated character sequence to a library function that expects a string.)

Unintentional truncation results in a loss of data and , in some cases , leads to software vulnerabilities.

...

Noncompliant Code Example

The standard functions strncpy() and strncat() copy a specified number of characters n from a source string to a destination array. If In the case of strncpy(), if there is no null character in the first n characters of the source array, the result will not be null-terminated and any remaining characters are truncated.

char *string_data;
char a[16];
/* ... */
strncpy(a, string_data, sizeof(a));

Compliant Solution (

...

Adequate Space)

Either the strcpy() or strncpy() function can be used to copy a string and a null character to a destination buffer, provided there is enough space. Care The programmer must be taken careful to ensure that the destination buffer is large enough to hold the string to be copied and the NULL null byte to prevent errors, such as data truncation and buffer overflow.

char *string_data = NULL;
char a[16];

/* ... */

if (string_data == NULL) {
  /* Handle null pointer error */
}
else if (strlen(string_data) >= sizeof(a)) {
  /* Handle overlong string error */
}
else {
  strcpy(a, string_data);
}

It is assumed This solution requires that string_data is NULL null-terminated, ; that is, a NULL null byte can be found within the bounds of the referenced character array. Otherwise, strlen() will stray into other objects before finding a NULL null byte.

Compliant Solution (

...

strcpy_s(), C11 Annex K)

The Wiki MarkupThe {{strcpy_s()}} function defined in \C11 Annex K  [[ISO/IEC TR 24731-1:2007|AA. C References#ISO/IEC TR 24731-1-2007]\] provides additional safeguards, including accepting the size of the destination buffer as an additional argument (see [STR07-A. Use TR 24731 for remediation of existing string manipulation code]). Also, {{9899:2011] provides additional safeguards, including accepting the size of the destination buffer as an additional argument. (See STR07-C. Use the bounds-checking interfaces for string manipulation.) Also, strnlen_s()}} accepts a maximum-length argument for strings that may not be null-terminated.

char *string_data = NULL;
char a[16];

/* ... */

if (string_data == NULL) {
  /* Handle null pointer error */
}
else if (strnlen_s(string_data, sizeof(a)) >= sizeof(a)) {
  /* Handle overlong string error */
}
else {
  strcpy_s(a, sizeof(a), string_data);
}

If a runtime-constraint error is detected by either the call to either strnlen_s() or strcpy_s(), the currently registered runtime-constraint handler is invoked. See ERR03-AC. Use runtime-constraint handlers when calling functions defined by TR24731-1the bounds-checking interfaces for more information on using runtime-constraint handlers with TR 24731-1 C11 Annex K functions.

Exceptions

STR03-C-EX1: The intent of the programmer is to intentionally purposely truncate the null-terminated byte string.

Risk Assessment

Truncating strings can lead to a loss of data.

Automated Detection

...

The LDRA tool suite V 7.6.0 is able to detect violations of this recommendation.

Fortify SCA Version 5.0 with CERT C Rule Pack can detect violations of this recommendation.

...

Tool	Version	Checker	Description
CodeSonar	Include Page CodeSonar_V CodeSonar_V	MISC.MEM.NTERM	No Space For Null Terminator
Compass/ROSE			Could detect violations in the following manner:

...

all calls to strncpy() and the other functions should be

...

followed by an assignment of a terminating character to null-terminate the string
GCC	8.1	-Wstringop-truncation	Detects string truncation by strncat and strncpy.
Klocwork	Include Page Klocwork_V Klocwork_V	NNTS.MIGHT NNTS.MUST
LDRA tool suite	Include Page LDRA_V LDRA_V	115 S, 44 S	Partially implemented
Parasoft C/C++test	Include Page Parasoft_V Parasoft_V	CERT_C-STR03-a	Avoid overflow due to reading a not zero terminated string
Polyspace Bug Finder	Include Page Polyspace Bug Finder_V Polyspace Bug Finder_V	CERT C: Rec. STR03-C	Checks for invalid use of standard library string routine (rec. partially supported)

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.21, "String handling <string.h>"
\[[Seacord 05a|AA. C References#Seacord 05a]\] Chapter 2, "Strings"
\[[ISO/IEC TR 24731-1:2007|AA. C References#ISO/IEC TR 24731-1-2007]\]

Related Guidelines

Bibliography

...

Image Added Image Added Image AddedSTR02-A. Sanitize data passed to complex subsystems      07. Characters and Strings (STR)       STR04-A. Use plain char for characters in the basic character set