Skip to main content
assistive.skiplink.to.breadcrumbs
assistive.skiplink.to.header.menu
assistive.skiplink.to.action.menu
assistive.skiplink.to.quick.search

Rule 07. Characters and Strings (STR)

Created by Robert C. Seacord, last modified by David Svoboda on May 06, 2025

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Page:

STR30-C. Do not attempt to modify string literals
Page:

STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator
Page:

STR32-C. Do not pass a non-null-terminated character sequence to a library function that expects a string
Page:

STR34-C. Cast characters to unsigned char before converting to larger integer sizes
Page:

STR37-C. Arguments to character-handling functions must be representable as an unsigned char
Page:

STR38-C. Do not confuse narrow and wide character strings and functions

Information for Editors
In order to have a new guideline automatically listed above be sure to label it str and rule.

Risk Assessment Summary

Rule	Severity	Likelihood	Detectable	Repairable	Priority	Level
STR30-C	Low	Likely	Low		P9	L2
STR31-C	High	Likely	Medium		P18	L1
STR32-C	High	Probable	Medium		P12	L1
STR34-C	Medium	Probable	Medium		P8	L2
STR37-C	Low	Unlikely	Low		P3	L3
STR38-C	High	Likely	Low		P27	L1

Related Rules and Recommendations

FIO20-C. Avoid unintentional truncation when using fgets() or fgetws()

FIO30-C. Exclude user input from format strings

FIO40-C. Reset strings on fgets() or fgetws() failure

FIO47-C. Use valid format strings

INT07-C. Use only explicitly signed or unsigned char type for numeric values

POS30-C. Use the readlink() function properly

STR37-C. Arguments to character-handling functions must be representable as an unsigned char

No labels