A string literal is a sequence of zero or more multibyte characters enclosed in double-quotes ("xyz", for example). A wide string literal is the same, except prefixed by the letter L (L"xyz", for example).
At compile time, string literals are used to create an array of static duration and sufficient length to contain the character sequence and a null-termination character. It is unspecified whether these arrays are distinct. The behavior is undefined if a program attempts to modify string literals but frequently results in an access violation, as string literals are typically stored in read-only memory.
Do not attempt to modify a string literal. Use a named array of characters to obtain a modifiable string.
Unable to render {include} The included page could not be found.
(include:STR30 CS 1)
Unable to render {include} The included page could not be found.
(include:STR30 CS 2)
Priority: P9 Level: L1
Modifying string literals can lead to abnormal program termination and results in undefined behavior that can be used in denial-of-service attacks.
Component |
Value |
|---|---|
Severity |
1 (low) |
Likelihood |
3 (likely) |
Remediation cost |
3 (low) |
References
- ISO/IEC 9899-1999 Section 6.4.5 String literals
- Summit 95 comp.lang.c FAQ list - Question 1.32
- Plum 91 Topic: 1.26 strings - string literals