The C standard allows an array variable to be declared both with a dimension index and with an initialization literal. The initialization literal also implies an array size, in the number of elements specified. For strings, the size specified by a string literal is the number of characters in the literal plus one for the terminating null character.
It is common for an array variable to be initialized by a string literal and declared with an explicit dimension which matches the number of characters in the string literal. This is one too few characters to hold the string, because it does not account for the terminating null character. Such a sequence of characters has limited utility and has the potential to cause vulnerabilities if a null-terminated byte string is assumed.
A better approach is to not specify the dimension of a string initialized with a string literal, as the compiler will automatically allocate sufficient space for the entire string literal, including the terminating null character. This rule is a specific exception to ARR02-A. Explicitly specify array dimensions, even if implicitly defined by an initializer.
Initializing a character array using a string literal to fit exactly without a null byte is not allowed in C++.
Non-Compliant Code Example
This non-compliant code example initializes an array of characters using a string literal that defines one more character (counting the terminating '\0') than the array can hold.
char s[3] = "abc";
The size of the array s is three, although the size of the string literal is four. Any subsequent use of the array as a null-terminated byte string can result in a vulnerability, because s is not properly null-terminated (see STR32-C. Null-terminate byte strings as required).
Compliant Solution
This compliant solution does not specify the dimension of a character array in the array declaration. If the array dimension is omitted, the compiler will allocate sufficient storage to store the entire string literal, including the terminating null character.
char s[] = "abc";
This is the preferred approach, because the size of the array can always be derived even if the size of the string literal changes.
Exceptions
STR36-EX1: If the intention is to create a character array and not a null-terminated byte string, initializing to fit exactly without a null byte is allowed but not recommended. The preferred approach to create an array containing just the three characters, 'a', 'b', and 'c', for example, is to declare each character literal as a separate element as follows:
char s[3] = { 'a', 'b', 'c' }; /* NOT a string */
Again, if one is providing an initializer to an array, an explicit dimension is unnecessary, and, in fact, discouraged.
Also, one should make clear in comments or documentation if a character array is, in fact, not a null-terminated byte string.
Risk Assessment
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
STR36-C |
high |
probable |
low |
P18 |
L1 |
Automated Detection
Splint Version 3.1.1 can detect violations of this rule.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
[[ECTC 98]] A.8, "Character array initialization"
[[ISO/IEC 9899:1999]] Section 6.7.8, "Initialization"
[[Seacord 05a]] Chapter 2, "Strings"
STR35-C. Do not copy data from an unbounded source to a fixed-length array 07. Characters and Strings (STR) STR37-C. Arguments to character handling functions must be representable as an unsigned char