STR32-C. Null-terminate strings as required

Strings must contain a null-termination character at or before the address of the last element of the array before they can be safely passed as arguments to standard string-handling functions, such as strcpy() or strlen(). This is because these functions, as well as other string-handling functions defined by C99 [ISO/IEC 9899:1999], depend on the existence of a null-termination character to determine the length of a string. Similarly, strings must be null-terminated before iterating on a character array where the termination condition of the loop depends on the existence of a null-termination character within the memory allocated for the string, as in the following example:

size_t i;
char str[16];
/* ... */
for (i = 0; i < sizeof(str); ++i) {
  if (str[i] == '\0') break;
  /* ... */
}

Failure to properly terminate strings can result in buffer overflows and other undefined behavior.

Noncompliant Code Example (strncpy())

The standard strncpy() function does not guarantee that the resulting string is null-terminated [ISO/IEC 9899:1999]. If there is no null character in the first n characters of the source array, the result could not be null-terminated.

In the first noncompliant code example, str is null-terminated before the call to strncpy(). However, the subsequent execution of strncpy() can overwrite the null-termination character.

char str[STR_SIZE];

str[sizeof(str)-1] = '\0';
strncpy(str, source, sizeof(str));

In the second noncompliant code example, memset() is used to clear the destination buffer; unfortunately, the third argument incorrectly specifies the size of the destination array [Schwarz 2005].

char str[STR_SIZE];

memset(str, 0, sizeof(str)-1);
strncpy(str, source, sizeof(str)-1);

Compliant Solution (Truncation)

The correct solution depends on the programmer's intent. If the intent was to truncate a string while ensuring that the result remains a null-terminated string, this solution can be used:

char str[STR_SIZE];

strncpy(str, source, sizeof(str)-1);
str[sizeof(str)-1] = '\0';

Compliant Solution (Copy without Truncation)

If the intent is to copy without truncation, this example copies the data and guarantees that the resulting string is null-terminated. If the string cannot be copied, it is handled as an error condition.

char *source = "0123456789abcdef";
char str[STR_SIZE];
/* ... */
if (source) {
  if (strlen(source) < sizeof(str)) {
    strcpy(str, source);
  }
  else {
    /* handle string too large condition */
  }
}
else {
  /* handle NULL string condition */
}

Compliant Solution (strncpy_s())

The strncpy_s() function copies up to n characters from the source array to a destination array [TR 24731]. If no null character was copied from the source array, then the nth position in the destination array is set to a null character, guaranteeing that the resulting string is null-terminated.

char *source;
char a[STR_SIZE];
/* ... */
if (source) {
  errno_t err = strncpy_s(a, sizeof(a), source, 5);
  if (err != 0) {
    /* Handle error */
  }
}
else {
  /* handle NULL string condition */
}

Noncompliant Code Example (realloc())

One method to decrease memory usage in critical situations when all available memory has been exhausted is to use the realloc() function to halve the size of message strings. The standard realloc() function has no concept of strings. As a result, if realloc() is called to decrease the memory allocated for a string, the null-termination character may be truncated.

The following noncompliant code example fails to ensure that cur_msg is properly null-terminated:

char *cur_msg = NULL;
size_t cur_msg_size = 1024;

/* ... */

void lessen_memory_usage(void) {
  char *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size/2 + 1;
    temp = realloc(cur_msg, temp_size);
    if (temp == NULL) {
      /* Handle error condition */
    }
    cur_msg = temp;
    cur_msg_size = temp_size;
  }
}

/* ... */

Because realloc() does not guarantee that the string is properly null-terminated, any subsequent operation on cur_msg that assumes a null-termination character may result in undefined behavior.

Compliant Solution (realloc())

In this compliant solution, the lessen_memory_usage() function ensures that the resulting string is always properly null-terminated.

char *cur_msg = NULL;
size_t cur_msg_size = 1024;

/* ... */

void lessen_memory_usage(void) {
  char *temp;
  size_t temp_size;

  /* ... */

  if (cur_msg != NULL) {
    temp_size = cur_msg_size/2 + 1;
    temp = realloc(cur_msg, temp_size);
    if (temp == NULL) {
      /* Handle error condition */
    }
    cur_msg = temp;
    cur_msg_size = temp_size;

    /* ensure string is null-terminated */
    cur_msg[cur_msg_size - 1] = '\0';
  }
}

/* ... */

Risk Assessment

Failure to properly null-terminate strings can result in buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process. Null-termination errors can also result in unintended information disclosure.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

CERT C++ Secure Coding Standard: STR32-CPP. Null-terminate character arrays as required

ISO/IEC 9899:1999 Section 7.1.1, "Definitions of terms," Section 7.20.3.4 "The realloc function," and Section 7.21, "String handling <string.h>"

ISO/IEC TR 24772 "CJM String Termination"

ISO/IEC TR 24731-1:2007 Section 6.7.1.4, "The strncpy_s function"

MITRE CWE: CWE-119, "Failure to Constrain Operations within the Bounds of an Allocated Memory Buffer"

MITRE CWE: CWE-170, "Improper Null Termination"

Bibliography

[Schwarz 2005]
[Seacord 2005a] Chapter 2, "Strings"
[Viega 2005] Section 5.2.14, "Miscalculated NULL termination"

      07. Characters and Strings (STR)      STR33-C. Size wide character strings correctly