Null-Terminated String Safety Issues in C: Buffer Overflows and Information Leaks

0s8 min★ 40 XP

Lesson 83Mixed lesson

Null-Terminated String Safety Issues in C: Buffer Overflows and Information Leaks

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format14 sections1 video4 code blocks1 practice itemUpdated Aug 27, 2026

The null-terminated string model has no length information. Every operation must scan for the terminator. If the terminator is missing, the scan overruns. If the buffer is too small, the write overflows. If untrusted input controls the string length, an attacker can trigger both. This is not a theoretical weakness. It is the root cause of thousands of CVEs spanning four decades. The Morris Worm in 1988 exploited a gets-based overflow in fingerd. The same class of bug appears in software shipped last year.

Null Terminated String Safety Issues

#The Classic Stack Buffer Overflow#link

#include <stdio.h>
#include <string.h>

void process_input(const char *user_data) {
    char buffer[16];
    strcpy(buffer, user_data);
    printf("Processed: %s\n", buffer);
}

int main(void) {
    process_input("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
    return 0;
}

Run stack_overflow_str (ASan catches it)

root@vulnarex:~#gcc -Wall -fsanitize=address stack_overflow_str.c -o stack_overflow_str && ./stack_overflow_str

33 bytes (32 A's plus the null) written into a 16-byte buffer. The overflow overwrites the saved frame pointer, the return address, and potentially adjacent stack frames. In a production exploit, the attacker replaces the return address with a pointer to shellcode placed in the overflow data. The function returns to the attacker's code instead of the caller. This is the canonical stack smashing attack.

#The Information Leak#link

#include <stdio.h>
#include <string.h>

int main(void) {
    char secret[16] = "API_KEY_12345";
    char output[8];

    strncpy(output, secret, sizeof(output));

    printf("Output: ");
    for (int i = 0; i < 16; i++) {
        printf("%02x ", (unsigned char)output[i]);
    }
    printf("\n");

    return 0;
}

Run info_leak demo

root@vulnarex:~#gcc -Wall -O0 info_leak.c -o info_leak && ./info_leak

strncpy filled all 8 bytes with no null terminator. If this buffer is sent over a network or written to a log with a length-based API, the receiver reads 8 bytes of the API key. If the buffer had been part of a larger struct, adjacent fields would leak too. The fix: always null-terminate after strncpy, and use length-bounded APIs for transmission.

#The Defense Checklist#link

Use fgets instead of gets (gets is removed from C11)Use snprintf instead of sprintfUse strncpy with manual null-termination, or strlcpy where availableValidate input length before copying into fixed buffersCompile with -fsanitize=address during developmentCompile with -D_FORTIFY_SOURCE=2 for runtime bounds checking in glibcUse ASan and Valgrind in CI pipelinesPrefer length-bounded APIs (memcpy with explicit size) over string functions for untrusted data

★ 40 XP

quiz BLOCK (★ 40 XP)

Why is gets() considered so dangerous that it was removed from the C11 standard?

Select your proof vectors above

String safety in C is not a language feature. It is a discipline. The tools exist: bounded functions, sanitizers, static analysis. The language does not force you to use them. That freedom is C's greatest strength and its greatest liability. Next: strnlen, a POSIX function that adds a bounds check to strlen.

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 40 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

The Classic Stack Buffer Overflow The Information Leak The Defense Checklist

Content

Last updated

August 27, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "https://vulnarex.com/api/content/lessons?courseSlug=c-programming-tutorials&lessonSlug=83-null-terminated-string-safety&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.

#include <stdio.h>

#include <string.h>

void process_input(const char *user_data) {

char buffer[16];

strcpy(buffer, user_data);

printf("Processed: %s\n", buffer);

}

int main(void) {

process_input("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");

return 0;

}

#include <stdio.h>

#include <string.h>

int main(void) {

char secret[16] = "API_KEY_12345";

char output[8];

strncpy(output, secret, sizeof(output));

printf("Output: ");

for (int i = 0; i < 16; i++) {

printf("%02x ", (unsigned char)output[i]);

}

printf("\n");

return 0;

}