unterminated-string-strncpy-stpncpy.yaml

rules:
  - id: raptor-unterminated-string-strncpy-stpncpy
    metadata:
      author: Marco Ivaldi <raptor@0xdeadbeef.info>
      references:
        - https://cwe.mitre.org/data/definitions/170
        - https://cwe.mitre.org/data/definitions/126
        - https://g.co/kgs/PCHQjJ
        - https://www.sei.cmu.edu/downloads/sei-cert-c-coding-standard-2016-v01.pdf
      confidence: MEDIUM
    # NOTE: other functions that do not NUL-terminate the destination
    # buffer are not covered (e.g., read(), readlink(), fread(), 
    # memcpy(), etc.).
    message: >-
      If there is no NUL character byte in the first n bytes of the source
      string, strncpy() and stpncpy() do not NUL-terminate the destination
      buffer. If the program does not explicitly terminate the destination
      buffer, this will almost certainly result in information disclosure,
      and possibly a buffer overflow condition.
    severity: WARNING
    languages:
      - c
      - cpp
    patterns:
      - pattern: $FUN(...)
      - metavariable-pattern:
          metavariable: $FUN
          pattern-either:
            - pattern: strncpy
            - pattern: stpncpy
            - pattern: wcsncpy
            - pattern: wcpncpy
      - pattern-not-inside: |
          $FUN($DST, $SRC, $N);
          ...
          $DST[$POS] = NULL;
      - pattern-not-inside: |
          $FUN($DST, $SRC, $N);
          ...
          $DST[$POS] = '\0';
      - pattern-not-inside: |
          $FUN($DST, $SRC, $N);
          ...
          $DST[$POS] = 0;