Using Safe String Functions

Many system security problems are caused by poor buffer handling and the resulting buffer overruns. Poor buffer handling is often associated with string manipulation operations. The standard string manipulation functions that are supplied by C/C++ language runtime libraries (strcat, strcpy, sprintf, and so on) do not prevent writing beyond the end of buffers.

Two new sets of string manipulation functions, called safe string functions, provide additional processing for proper buffer handling in your code. These safe string functions are available for Microsoft® Windows® XP SP1 and later versions of the Windows DDK and Platform SDK. They are intended to replace their built-in C/C++ counterparts and similar routines that are supplied by Microsoft Windows.

One set of safe string functions are for use in kernel-mode code. These functions are prototyped in a header file named ntstrsafe.h. This header file and an associated library are available in the Windows DDK.

The other set of safe string functions are for use in user-mode applications. A corresponding header file, strsafe.h, contains prototypes for these functions. That file and an associated library are available in the Platform SDK. For more information about strsafe.h, see the Microsoft Developer Network (MSDN) Web site.

The kernel-mode safe string functions provide the following features:

• Each function receives the size of the destination buffer as input. The function can thus ensure that it does not write past the end of the buffer.
• The functions null-terminate all output strings, even if the operation truncates the intended result.
• All functions return an NTSTATUS value, with only one possible success code (STATUS_SUCCESS).
• Each function is available in both a byte-counted and a character-counted version. For example, RtlStringCbCatW and RtlStringCchCatW.
• Each function is available in both a W-suffixed version that supports double-byte Unicode characters and an A-suffixed version that supports single-byte ANSI characters. For example, RtlStringCbCatW and RtlStringCbCatA.
• Most functions are available in an extended, Ex-suffixed version that provides advanced functionality. For example, RtlStringCbCatW and RtlStringCbCatExW.

This section includes the following topics:

Summary of Kernel-Mode Safe String Functions

Importing Kernel-Mode Safe String Functions