Copying data in to a buffer that is not large enough to hold that data results in a buffer overflow. While not limited to Null Terminated Byte Strings (NTBS), this type of error often occurs when manipulating NTBS data. To prevent such errors, limit copies either through truncation (although consult [[STR03-A. Do not inadvertently truncate a null-terminated byte string]] for problems that may cause) or, preferably, ensure that the destination is of sufficient size to hold the character data to be copied and the null termination character.
Unable to render {include} The included page could not be found.
Unable to render {include} The included page could not be found.
strcpy()
Unable to render {include} The included page could not be found.
Unable to render {include} The included page could not be found.
Unable to render {include} The included page could not be found.
getenv()
Unable to render {include} The included page could not be found.
Unable to render {include} The included page could not be found.
Risk Assessment
Copying NTBS data to a buffer that is too small to hold that data results in a buffer overflow. Attackers can use this to execute arbitrary code.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
STR31-C |
3 (high) |
3 (likely) |
2 (medium) |
P18 |
L1 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
[[Dowd 06]] Chapter 7, "Program Building Blocks" (Loop Constructs 327-336)
[[ISO/IEC 9899-1999]] Section 7.1.1, "Definitions of terms," Section 7.21, "String handling <string.h>," Section 5.1.2.2.1, "Program startup," and Section 7.20.4.5, "The getenv function"
[[Seacord 05]] Chapter 2, "Strings"
Vulnerabilities
07. Characters and Strings (STR) STR32-C. Null-terminate byte strings as required