| Wiki Markup |
|---|
Null-terminated byte strings (NTBS) must contain a NULLnull-termination character at or before the address of the last element of the array before they can be safely passed as arguments to standard string-handling functions, such as {{strcpy()}} or {{strlen()}}. This is because these functions, as well as other string-handling functions defined by C99 \[[ISO/IEC 9899-:1999|AA. C References#ISO/IEC 9899-1999]\], depend on the existence of a NULLnull-termination character to determine the length of a string. Similarly, NTBS must be NULL terminated before iterating on a character array where the termination condition of the loop depends on the existence of a NULLnull-termination character within the memory allocated for the string, as in the following example: |
...
Failure to properly terminate NULLnull-terminated byte strings can result in buffer overflows and other undefined behavior.
...
| Wiki Markup |
|---|
The standard {{strncpy()}} function does not guarantee that the resulting string is NULL terminated \[[ISO/IEC 9899-:1999|AA. C References#ISO/IEC 9899-1999]\]. If there is no NULLnull character in the first {{n}} characters of the {{source}} array, the result may not be NULL terminated. |
In the first non-compliant coding code example, ntbs is NULL terminated before the call to strncpy(). However, the subsequent execution of strncpy() may overwrite the NULLnull-termination character.
| Code Block | ||
|---|---|---|
| ||
char ntbs[NTBS_SIZE]; ntbs[sizeof(ntbs)-1] = '\0'; strncpy(ntbs, source, sizeof(ntbs)); |
...
The correct solution depends on the programmer's intent. If the intent was to truncate a string but ensure that the result remains a NULLnull-terminated string, this solution can be used:
...
If the intent is to copy without truncation, this example copies the data and guarantee that the resulting NULLnull-terminated byte string is NULL terminated. If the string cannot be copied, it is handled as an error condition.
...
| Wiki Markup |
|---|
The {{strncpy_s()}} function copies up to {{n}} characters from the source array to a destination array \[[TR 24731|AA. C References#ISO/IEC TR 24731-1-2007]\]. If no NULLnull character was copied from the source array, then the {{n{}}}th position in the destination array is set to a NULLnull character, guaranteeing that the resulting string is NULLnull-terminated. |
This compliant solution also guarantees that the string is NULL terminated.
...
One method to decrease memory usage in critical situations when all available memory has been exhausted is to use the realloc() function to halve the size of message strings. The standard realloc() function has no concept of NULLnull-terminated byte strings. As a result, if realloc() is called to decrease the memory allocated for a NULLnull-terminated byte string, the NULL termination character may be truncated.
...
Because realloc() does not guarantee that the string is properly NULL terminated, any subsequent operation on cur_msg that assumes a NULLnull-termination character may result in undefined behavior.
...
| Code Block | ||
|---|---|---|
| ||
char *cur_msg = NULL;
size_t cur_msg_size = 1024;
/* ... */
void lessen_memory_usage(void) {
char *temp;
size_t temp_size;
/* ... */
if (cur_msg != NULL) {
temp_size = cur_msg_size/2 + 1;
temp = realloc(cur_msg, temp_size);
if (temp == NULL) {
/* Handle error condition */
}
cur_msg = temp;
cur_msg_size = temp_size;
/* ensure string is NULLnull-terminated */
cur_msg[cur_msg_size - 1] = '\0';
}
}
/* ... */
|
...
| Wiki Markup |
|---|
\[[ISO/IEC 9899-:1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.1.1, "Definitions of terms," Section 7.20.3.4 "The realloc function," and Section 7.21, "String handling <string.h>" \[[ISO/IEC TR 24731-1-:2007|AA. C References#ISO/IEC TR 24731-1-2007]\] Section 6.7.1.4, "The strncpy_s function" \[[Schwarz 05|AA. C References#Schwarz 05]\] \[[Seacord 05|AA. C References#Seacord 05]\] Chapter 2, "Strings" \[[Viega 05|AA. C References#Viega 05]\] Section 5.2.14, "Miscalculated NULL termination" |
...