...
This solution requires that string_data is null-terminated; that is, a null byte can be found within the bounds of the referenced character array. Otherwise, strlen() will stray into other objects before finding a null byte.
Compliant Solution (strcpy_s(), C11 Annex K)
The strcpy_s() function defined in C11 Annex K [ISO/IEC 9899:2011] provides additional safeguards, including accepting the size of the destination buffer as an additional argument. (See STR07-C. Use the bounds-checking interfaces for string manipulation.) Also, strnlen_s() accepts a maximum-length argument for strings that may not be null-terminated.
| Code Block | ||||
|---|---|---|---|---|
| ||||
char *string_data = NULL;
char a[16];
/* ... */
if (string_data == NULL) {
/* Handle null pointer error */
}
else if (strnlen_s(string_data, sizeof(a)) >= sizeof(a)) {
/* Handle overlong string error */
}
else {
strcpy_s(a, sizeof(a), string_data);
}
|
If a runtime-constraint error is detected by the call to either strnlen_s() or strcpy_s(), the currently registered runtime-constraint handler is invoked. See ERR03-C. Use runtime-constraint handlers when calling the bounds-checking interfaces for more information on using runtime-constraint handlers with C11 Annex K functions.
Exceptions
Exceptions
STR03-C-STR03-EX1: The intent of the programmer is to purposely truncate the string.
...
Truncating strings can lead to a loss of data.
Recommendation | Severity | Likelihood | Detectable |
|---|
Repairable | Priority | Level |
|---|---|---|
STR03-C | Medium | Probable |
No | No |
P4 |
L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| MISC.MEM.NTERM | No Space For Null Terminator | ||||||
| Compass/ROSE |
Could detect violations in the following manner: all calls to |
5.0
| GCC | 8.1 | -Wstringop-truncation | Detects string truncation by strncat and strncpy. | ||||||
| Helix QAC |
| C1619 | |||||||
| Klocwork |
| NNTS.MIGHT |
NNTS.MUST | |||||||||
| LDRA tool suite |
| 115 S, 44 S | Partially implemented | ||||||
| Parasoft C/C++test |
| CERT_C-STR03-a | Avoid overflow due to reading a not zero terminated string | ||||||
| Polyspace Bug Finder |
| CERT C: Rec. STR03-C | Checks for invalid use of standard library string routine (rec. partially supported) |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| SEI CERT C++ Coding Standard | VOID STR03-CPP. Do not inadvertently truncate a null-terminated character array |
| ISO/IEC TR 24772:2013 | String Termination [CJM] |
| MITRE CWE | CWE-170, Improper null termination CWE-464, Addition of data structure sentinel |
Bibliography
| [Seacord 2013] | Chapter 2, "Strings" |
...
...