SEI publications feed

Specifications for Managed Strings

Vodcasts & Feed

Robert Seacord's vodcasts
on secure coding


CERT's secure coding
video series feed

Hal Burch
Fred Long
Robert Seacord

Technical Report
CMU/SEI-2006-TR-006

PDF File

This report describes a managed string library for the C programming language. Many software vulnerabilities in C programs result from the misuse of standard C string manipulation functions. Programming errors common to string manipulation logic include buffer overflow, truncation errors, string termination errors, and improper data sanitation. The managed string library provides mechanisms to eliminate or mitigate these problems and improve system security. A proof-of-concept implementation of the managed string library is available from the Secure Coding area of the CERT Web site.