## Syntax  
Strings in the programming language C are arrays of characters, whose length is determined by a terminating null character '\(\backslash\)0'. Thus, for example, the string literal \"bee\" has four characters: 'b', 'e', 'e', '\(\backslash\)0'. Moreover, C supports several string handling functions defined in the standard library string.h.  
We focus on the most significant functions in the string.h header (see Table 1), manipulating null-terminated sequences of characters, plus the array elements access and update operations. Recall that char, int and size_t are data types in C, const is a qualifier applied to the declaration of any variable which specifies the immutability of its value, and *str denotes that str is a pointer variable.  
* strcat appends the null-terminated string pointed to by str2 to the null-terminated string pointed to by str1. The first character of str2 overwrites the null-terminator of str1 and str2 should not overlap str1. The string concatenation returns the pointer str1.
* strchr locates the first occurrence of c (converted to a char) in the string pointed to by str. The terminating null character is considered to be part of the string. The string character function returns a pointer to the located character, or a null pointer if the character does not occur in the string.
* strcmp lexicographically compares the string pointed to by str1 to the string pointed to by str2. The string compare function returns an integer greater than, equal to, or less than zero, accordingly as the string pointed to by str1 is greater than, equal to, or less than the string pointed to by str2.
* strcpy copies the null-terminated string pointed to by str2 to the memory pointed to by str1. str2 should not overlap str1. The string copy function returns the pointer str1.
* strlen computes the number of bytes in the string to which str points, not including the terminating null byte. The string length function returns the length of str.  
Accessing an array element is possible indexing the array name. Let i be an index, the i-th element of the character array str is accessed by str[i]. On the other hand, a character array element is updated (or an assignment is performed to a character array element) by str[i] = 'x', where 'x' denotes a character literal.  
As mentioned in Section 1, C does not guarantee bounds checking on array accesses and, in case of strings, the language does not ensure that the latter are null-terminated. As a consequence, improper string manipulation leads to several vulnerabilities and exploits [15]. For instance, if non null-terminated strings are passed to the functions above, the latter may return misleading results or read out of the array bound. Moreover, since strcat and strcpy do not allow the size of the destination array str1 to be specified, they are frequent sources of buffer overflows.  
\begin{table}
\begin{tabular}{c} \hline char *strcat(char *str1, const char *str2) \\ \hline char *strchr(char *str, int c) \\ \hline int strcmp(const char *str1, const char *str2) \\ \hline char *strcpy(char *str1, const char *str2) \\ \hline size\_t strlen(const char *str) \\ \hline \end{tabular}
\end{table}
Table 1: String functions syntax in C.