Skip to content

Unbounded String Length Calculation

Description

The `strlen` family of functions does not handle strings that are not null-terminated, leading to potential buffer over-reads and crashes by accessing unintended memory locations. It is recommended to use `strnlen` instead, providing a `maxlen` value.

Examples

Insecure Code

c
size_t length = strlen(input);

Secure Code

c
size_t length = strnlen(input, MAX_LENGTH);

Remediation

Replace `strlen` with `strnlen` and provide a maximum length value.

Rule Details

FieldValue
IDCODE-0582
CategoryInjection
SeverityHIGH
CWECWE-126
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityEASY
Tagsbuffer over-read, null-terminated string
OWASPA1:2017-Injection, A03:2021-Injection