Alternative functions that limit the number of bytes copied are often recommended to mitigate buffer overflow vulnerabilities. Examples include
These functions truncate strings that exceed the specified limits. Additionally, some functions, such as
strncpy(), do not guarantee that the resulting character sequence is null-terminated. (See STR32-C. Do not pass a non-null-terminated character sequence to a library function that expects a string.)
Unintentional truncation results in a loss of data and in some cases leads to software vulnerabilities.
Noncompliant Code Example
The standard functions
strncat() copy a specified number of characters
n from a source string to a destination array. In the case of
strncpy(), if there is no null character in the first
n characters of the source array, the result will not be null-terminated and any remaining characters are truncated.
Compliant Solution (Adequate Space)
strncpy() function can be used to copy a string and a null character to a destination buffer, provided there is enough space. The programmer must be careful to ensure that the destination buffer is large enough to hold the string to be copied and the null byte to prevent errors, such as data truncation and buffer overflow.
This solution requires that
string_data is null-terminated; that is, a null byte can be found within the bounds of the referenced character array. Otherwise,
strlen() will stray into other objects before finding a null byte.
Compliant Solution (
strcpy_s(), C11 Annex K)
strcpy_s() function defined in C11 Annex K [ISO/IEC 9899:2011] provides additional safeguards, including accepting the size of the destination buffer as an additional argument. (See STR07-C. Use the bounds-checking interfaces for string manipulation.) Also,
strnlen_s() accepts a maximum-length argument for strings that may not be null-terminated.
If a runtime-constraint error is detected by the call to either
strcpy_s(), the currently registered runtime-constraint handler is invoked. See ERR03-C. Use runtime-constraint handlers when calling the bounds-checking interfaces for more information on using runtime-constraint handlers with C11 Annex K functions.
STR03-C-EX1: The intent of the programmer is to purposely truncate the string.
Truncating strings can lead to a loss of data.
|MISC.MEM.NTERM||No Space For Null Terminator|
Could detect violations in the following manner: all calls to
|GCC||8.1||Detects string truncation by |
|LDRA tool suite|
115 S, 44 S
Avoid overflow due to reading a not zero terminated string
|Polyspace Bug Finder|
|Buffer overflow from incorrect string format specifier|
String format specifier causes buffer argument of standard library functions to overflow
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
|SEI CERT C++ Coding Standard||VOID STR03-CPP. Do not inadvertently truncate a null-terminated character array|
|ISO/IEC TR 24772:2013||String Termination [CJM]|
|MITRE CWE||CWE-170, Improper null termination|
CWE-464, Addition of data structure sentinel
|[Seacord 2013]||Chapter 2, "Strings"|