ABV.UNICODE.NNTS_MAP checks for buffer overrun conditions caused in MultiByteToWideChar and WideCharToMultiByte mapping functions by non null-terminated strings. Typically, the checker detects the condition when either function doesn't terminate the output string automatically.

For more information on the operation of the MultiByteToWideChar and WideCharToMultiByte mapping functions, see the MSDN website.

Vulnerability and risk

Using these mapping functions incorrectly can compromise the security of an application by causing a buffer overflow. To avoid this potential condition, it's important to null-terminate the output string for the function.

Vulnerable code example

     1  #include <windows.h>
     2  #include <stdio.h>
     3  #include <wchar.h>
     4  #include <string.h>
     5  
     6  int main() 
     7  {
     8      wchar_t wstrTestNNTS[] = L"0123456789ABCDEF";
     9      char strTestNNTS[16];
    10      int res = WideCharToMultiByte(CP_UTF8, 0, wstrTestNNTS, -1, strTestNNTS, 16, NULL, NULL);
    11      printf("res = %d\n", res);
    12      printf("strTestNNTS = %s\n", strTestNNTS);
    13      return 0;
    14  }

Klocwork produces a NNTS report for function 'WideCharToMultiByte', because this function is not guaranteed to write the null termination character at the end of the string. If the destination buffer is used without checking the return value, the non-null terminated string may overflow.

Fixed code example

     1  #include <windows.h>
     2  #include <stdio.h>
     3  #include <wchar.h>
     4  #include <string.h>
     5  
     6  int main() 
     7  {
     8      wchar_t wstrTestNNTS[] = L"0123456789ABCDEF";
     9      char strTestNNTS[16];
    10      int res = WideCharToMultiByte(CP_UTF8, 0, wstrTestNNTS, -1, strTestNNTS, 16, NULL, NULL);
    11      if (res == sizeof(strTestNNTS)) {
    12          strTestNNTS[res-1] = NULL;
    13      } else {
    14          strTestNNTS[res] = NULL;
    15      }
    16      printf("res = %d\n", res);
    17      printf("strTestNNTS = %s\n", strTestNNTS);
    18      return 0;
    19  }

In the fixed code example, the return value of the function is checked at lines 11 to 14, and the null termination character is added if it's needed.

Related checkers

External guidance

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning C/C++ analysis for more information.