The Null Terminator in C: The Byte That Defines Every String

A C string is not a type. It is a convention: a sequence of bytes ending with a zero byte, \0, ASCII 0, the null terminator. Every string function in the standard library walks memory until it finds that byte. strlen counts bytes before it. printf %s prints bytes before it. strcpy copies bytes until it hits it in the source and writes it to the destination. Remove that byte and the functions keep walking. Into the next variable. Into the next stack frame. Until they hit another zero or segfault.

The broken array has no null terminator. strlen reads past the five characters into adjacent stack memory until it finds a zero byte. It counted 7. printf printed garbage after the exclamation marks. The \x7f is a non-printable byte from the stack. In a security context, this is an information disclosure: the function is leaking stack contents to the output.

#Where the Terminator Gets Lost#link

Three common scenarios. First, strncpy with a count equal to the buffer size, which we covered. Second, manual character-by-character construction where you forget to place \0 at the end. Third, reading binary data that happens to contain no zero bytes and then passing it to a string function. In all three cases, the fix is the same: explicitly place the null terminator and verify it is within bounds.

The explicit buf[i++] = '\0' is the line that makes this a string. Without it, buf is just a byte array. The string functions do not know where you intended the data to end. Only the null terminator tells them.

The null terminator is the entire string abstraction. One byte. No metadata. No length field. No bounds. Just a zero that says "stop here." It is elegant and terrifying in equal measure. Next: the security issues that arise when null-terminated strings meet untrusted input.