Description

The software does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

Extended Description

Null termination errors frequently occur in two different ways. An off-by-one error could cause a null to be written out of bounds, leading to an overflow. Or, a program could use a strncpy() function call incorrectly, which prevents a null terminator from being added at all. Other scenarios are possible.

Likelihood of Exploit: Medium

Applicable Platforms
Language: C
Language: C++

Time Of Introduction

• Implementation

Common Consequences

Detection Methods
None

Potential Mitigations

Relationships
Factors: this is usually resultant from other weaknesses such as off-by-one errors, but it can be primary to boundary condition violations such as buffer overflows. In buffer overflows, it can act as an expander for assumed-immutable data.
Overlaps missing input terminator.

Demonstrative Examples   (Details)

1. In the following code, readlink() expands the name of a symbolic link stored in the buffer path so that the buffer filename contains the absolute path of the file referenced by the symbolic link. The length of the resulting value is then calculated using strlen().
2. The following code reads from cfgfile and copies the input into inputbuf using strcpy(). The code mistakenly assumes that inputbuf will always contain a NULL terminator.
3. While the following example is not exploitable, it provides a good example of how nulls can be omitted or misplaced, even when "safe" functions are used:

Observed Examples

1. CVE-2000-0312 : Attacker does not null-terminate argv[] when invoking another program.
2. CVE-2003-0777 : Interrupted step causes resultant lack of null termination.
3. CVE-2004-1072 : Fault causes resultant lack of null termination, leading to buffer expansion.
4. CVE-2001-1389 : Multiple vulnerabilities related to improper null termination.
5. CVE-2003-0143 : Product does not null terminate a message buffer after snprintf-like call, leading to overflow.

White Box Definitions
A weakness where the code path has:
1. end statement that passes a data item to a null-terminated string function
2. start statement that produces the improper null-terminated data item
Where "produces" is defined through the following scenarios:
1. data item never ended with null-terminator
2. null-terminator is re-written

Black Box Definitions
None

Taxynomy Mappings

References:
None