Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

This is an extension of recommendation: The type of a narrow string literal is an array of char, and the type of a wide string literal is an array of wchar_t. However, string literals (of both types) are notionally constant and should consequently be protected by const qualification. This recommendation is a specialization of DCL00-C. Const-qualify immutable objects and also supports STR30-C. Do not attempt to modify string literals

Since string literals are constant, they should only be assigned to constant pointers as indicated below:

.

Adding const qualification may propagate through a program; as const qualifiers are added, still more become necessary. This phenomenon is sometimes called const-poisoning. Const-poisoning can frequently lead to violations of EXP05-C. Do not cast away a const qualification. Although const qualification is a good idea, the costs may outweigh the value in the remediation of existing code.

Noncompliant Code Example (Narrow String Literal)

In this noncompliant code example, the const keyword has been omitted:

Code Block
bgColor#FFcccc
langc
char *c = "Hello";

If a statement such as c[0] = 'C' were placed following the declaration in the noncompliant code example, the code is likely to compile cleanly, but the result of the assignment would be undefined because string literals are considered constant.

Compliant Solution (Immutable Strings)

In this compliant solution, the characters referred to by the pointer c are const-qualified, meaning that any attempt to assign them to different values is an error:

Code Block
bgColor#ccccFF
langc
const char *c = "Hello";

Compliant Solution (Mutable Strings)

In cases where the string is meant to be modified, use initialization instead of assignment. In this compliant solution, c is a modifiable char array that has been initialized using the contents of the corresponding string literal:

Code Block
bgColor#ccccFF
langc
char c[
Code Block

char* c1 = "Hello"; // Bad: assigned to non-const
char c2[] = "Hello"; // Bad: assigned to non-const
char c3[6] = "Hello"; // Bad: assigned to non-const
c1[3] = 'a'; // Undefined (but compiles)
const char* c1 = "Hello"; // Good
const char c2[] = "Hello"; // Good
const char c3\[6] = "Hello"; // Good
c1[3] = 'a'; // Compile error

By assigning string literals to constant pointers the compiler will warn you if you try to modify them. 

Resource to use to find out more about an ongoing debate about this issue:

http://www.open-std.org/jtc1/sc22/wg21/docs/papers/1993/N0389.asc 


Consequently, a statement such as c[0] = 'C' is valid and behaves as expected.

Noncompliant Code Example (Wide String Literal)

In this noncompliant code example, the const keyword has been omitted:

Code Block
bgColor#FFcccc
langc
wchar_t *c = L"Hello";

If a statement such as c[0] = L'C' were placed following this declaration, the code is likely to compile cleanly, but the result of the assignment would be undefined because string literals are considered constant.

Compliant Solution (Immutable Strings)

In this compliant solution, the characters referred to by the pointer c are const-qualified, meaning that any attempt to assign them to different values is an error:

Code Block
bgColor#ccccFF
langc
wchar_t const *c = L"Hello";

Compliant Solution (Mutable Strings)

In cases where the string is meant to be modified, use initialization instead of assignment. In this compliant solution, c is a modifiable wchar_t array that has been initialized using the contents of the corresponding string literal:

Code Block
bgColor#ccccFF
langc
wchar_t c[] = L"Hello";

Consequently, a statement such as c[0] = L'C' is valid and behaves as expected.

Risk Assessment

Modifying string literals causes undefined behavior, resulting in abnormal program termination and denial-of-service vulnerabilities.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

STR05-C

Low

Unlikely

Low

P3

L3

Automated Detection

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V
literal-assignment
Fully checked
Axivion Bauhaus Suite

Include Page
Axivion Bauhaus Suite_V
Axivion Bauhaus Suite_V

CertC-STR05
Clang

Include Page
Clang_V
Clang_V

-Wwrite-stringsNot enabled by -Weverything
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V
LANG.TYPE.NCSNon-const string literal
Compass/ROSE




ECLAIR

Include Page
ECLAIR_V
ECLAIR_V

CC2.STR05

Fully implemented

GCC

Include Page
GCC_V
GCC_V

-Wwrite-strings
Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C0752, C0753
Klocwork

Include Page
Klocwork_V
Klocwork_V

MISRA.STRING_LITERAL.NON_CONST.2012
LDRA tool suite
Include Page
LDRA_V
LDRA_V
623 S

Fully implemented

Parasoft C/C++test

Include Page
Parasoft_V
Parasoft_V

CERT_C-STR05-a

A string literal shall not be modified

PC-lint Plus

Include Page
PC-lint Plus_V
PC-lint Plus_V

1776

Fully supported

RuleChecker
Include Page
RuleChecker_V
RuleChecker_V
literal-assignmentFully checked

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Bibliography


...

Image Added Image Added Image Added Wiki Markup\[Lockheed Martin 2005\] Lockheed Martin. Joint Strike Fighter Air Vehicle C+\+ Coding Standards for the System Development and Demonstration Program. Document Number 2RDU00001, Rev C. December 2005.     AV Rule 151.1