Many library functions accept a string or wide string argument with the constraint that the string they receive is properly null-terminated. Passing a character sequence or wide character sequence that is not null-terminated to such a function can result in accessing memory that is outside the bounds of the object. Do not pass a character sequence or wide character sequence that is not null-terminated to a library function that expects a string or wide string argument.
Noncompliant Code Example
This code example is noncompliant because the character sequence
c_str
will not be null-terminated when passed as an argument to
printf().
(See STR11-C.
Do not specify the bound of a character array initialized with a
string literal on how to properly initialize character arrays.)
#include <stdio.h>
void
func(
void
) {
char
c_str[3] =
"abc"
;
printf
(
"%s\n"
, c_str);
}
|
Compliant Solution
This compliant solution does not specify the bound of the character array in the array declaration. If the array bound is omitted, the compiler allocates sufficient storage to store the entire string literal, including the terminating null character.
#include <stdio.h>
void
func(
void
) {
char
c_str[] =
"abc"
;
printf
(
"%s\n"
, c_str);
}
|
Noncompliant Code Example
This code example is noncompliant because the wide character sequence
cur_msg
will not be null-terminated when passed to
wcslen()
. This will occur if
lessen_memory_usage()
is invoked while
cur_msg_size
still has its initial value of 1024.
#include <stdlib.h>
#include <wchar.h>
wchar_t
*cur_msg = NULL;
size_t
cur_msg_size = 1024;
size_t
cur_msg_len = 0;
void
lessen_memory_usage(
void
) {
wchar_t
*temp;
size_t
temp_size;
/* ... */
if
(cur_msg != NULL) {
temp_size = cur_msg_size / 2 +
1;
temp =
realloc
(cur_msg, temp_size *
sizeof
(
wchar_t
));
/* temp &and cur_msg may
no longer be null-terminated */
if
(temp == NULL) {
/* Handle error */
}
cur_msg = temp;
cur_msg_size = temp_size;
cur_msg_len = wcslen(cur_msg);
}
}
|
Compliant Solution
In this compliant solution,
cur_msg
will always be null-terminated when passed to
wcslen()
:
#include <stdlib.h>
#include <wchar.h>
wchar_t
*cur_msg = NULL;
size_t
cur_msg_size = 1024;
size_t
cur_msg_len = 0;
void
lessen_memory_usage(
void
) {
wchar_t
*temp;
size_t
temp_size;
/* ... */
if
(cur_msg != NULL) {
temp_size = cur_msg_size / 2 +
1;
temp =
realloc
(cur_msg, temp_size *
sizeof
(
wchar_t
));
/* temp and cur_msg may no
longer be null-terminated */
if
(temp == NULL) {
/* Handle error */
}
cur_msg = temp;
/* Properly null-terminate
cur_msg */
cur_msg[temp_size - 1] = L
'\0'
;
cur_msg_size = temp_size;
cur_msg_len = wcslen(cur_msg);
}
}
|
Noncompliant Code Example (
strncpy()
)
Although the
strncpy()
function takes a string as input, it does not guarantee that the
resulting value is still null-terminated. In the following
noncompliant code example, if no null character is contained in the
first
n
characters of the
source
array, the result will not be null-terminated. Passing a
non-null-terminated character sequence to
strlen()
is undefined behavior.
#include <string.h>
enum
{ STR_SIZE = 32 };
size_t
func(
const
char
*source) {
char
c_str[STR_SIZE];
size_t
ret = 0;
if
(source) {
c_str[
sizeof
(c_str) - 1] =
'\0'
;
strncpy
(c_str, source,
sizeof
(c_str));
ret =
strlen
(c_str);
}
else
{
/* Handle null pointer */
}
return
ret;
}
|
Compliant Solution (Truncation)
This compliant solution is correct if the programmer's intent is to truncate the string:
#include <string.h>
enum
{ STR_SIZE = 32 };
size_t
func(
const
char
*source) {
char
c_str[STR_SIZE];
size_t
ret = 0;
if
(source) {
strncpy
(c_str, source,
sizeof
(c_str) - 1);
c_str[
sizeof
(c_str) - 1] =
'\0'
;
ret =
strlen
(c_str);
}
else
{
/* Handle null pointer */
}
return
ret;
}
|
Compliant Solution (Truncation, strncpy_s())
The C Standard, Annex K
strncpy_s()
function can also be used to copy with truncation. The
strncpy_s()
function copies up to
n
characters from the source array to a destination array. If no null
character was copied from the source array, then the
n
th position in the destination array is set to a null character,
guaranteeing that the resulting string is null-terminated.
#define
__STDC_WANT_LIB_EXT1__ 1
#include <string.h>
enum
{ STR_SIZE = 32 };
size_t
func(
const
char
*source) {
char
a[STR_SIZE];
size_t
ret = 0;
if
(source) {
errno_t err = strncpy_s(
a,
sizeof
(a), source,
strlen
(source)
);
if
(err != 0) {
/* Handle error */
}
else
{
ret = strnlen_s(a,
sizeof
(a));
}
}
else
{
/* Handle null pointer */
}
return
ret;
}
|
Compliant Solution (Copy without Truncation)
If the programmer's intent is to copy without truncation, this compliant solution copies the data and guarantees that the resulting array is null-terminated. If the string cannot be copied, it is handled as an error condition.
#include <string.h>
enum
{ STR_SIZE = 32 };
size_t
func(
const
char
*source) {
char
c_str[STR_SIZE];
size_t
ret = 0;
if
(source) {
if
(
strlen
(source) <
sizeof
(c_str)) {
strcpy
(c_str, source);
ret =
strlen
(c_str);
}
else
{
/* Handle string-too-large */
}
}
else
{
/* Handle null pointer */
}
return
ret;
}
|