Skip to main content
assistive.skiplink.to.breadcrumbs
assistive.skiplink.to.header.menu
assistive.skiplink.to.action.menu
assistive.skiplink.to.quick.search

Rule 07: Characters and Strings (STR)

Created by Robert C. Seacord, last modified by Will Snavely on Mar 30, 2015

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Page:

STR30-C. Do not attempt to modify string literals
Page:

STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator
Page:

STR32-C. Do not pass a non-null-terminated character sequence to a library function that expects a string
Page:

STR34-C. Cast characters to unsigned char before converting to larger integer sizes
Page:

STR37-C. Arguments to character-handling functions must be representable as an unsigned char
Page:

STR38-C. Do not confuse narrow and wide character strings and functions

Information for Editors
In order to have a new guideline automatically listed above be sure to label it str and rule.

Risk Assessment Summary

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
STR00-C	Medium	Probable	Low	P12	L1
STR01-C	Low	Unlikely	High	P1	L3
STR02-C	High	Likely	Medium	P18	L1
STR03-C	Medium	Probable	Medium	P8	L2
STR04-C	Low	Unlikely	Low	P3	L3
STR05-C	Low	Unlikely	Low	P3	L3
STR06-C	Medium	Likely	Medium	P12	L1
STR07-C	High	Probable	Medium	P12	L1
STR08-C	High	Probable	High	P6	L2
STR09-C	Low	Unlikely	Low	P3	L3
STR10-C	Low	Probable	Medium	P4	L3
STR11-C	Low	Probable	Low	P6	L2
STR30-C	Low	Likely	Low	P9	L2
STR31-C	High	Likely	Medium	P18	L1
STR32-C	High	Probable	Medium	P12	L1
STR34-C	Medium	Probable	Medium	P8	L2
STR37-C	Low	Unlikely	Low	P3	L3
STR38-C	High	Likely	Low	P27	L1

Related Rules and Recommendations

FIO20-C. Avoid unintentional truncation when using fgets() or fgetws()

FIO30-C. Exclude user input from format strings

FIO40-C. Reset strings on fgets() or fgetws() failure

FIO47-C. Use valid format strings

INT07-C. Use only explicitly signed or unsigned char type for numeric values

POS30-C. Use the readlink() function properly

STR37-C. Arguments to character-handling functions must be representable as an unsigned char

No labels