C string handling
The C programming language has a set of functions implementing operations on strings (character strings and byte strings) in its standard library. Various operations, such as copying, concatenation, tokenization and searching are supported. For character strings, the standard library uses the convention that strings are null-terminated: a string of characters is represented as an array of elements, the last of which is a character (with numeric value 0). The only support for strings in the programming language proper is that the compiler translates quoted string constants into null-terminated strings. Definitions. A string is defined as  a contiguous sequence of code units terminated by the first zero code unit (often called the "NUL" code unit). This means a string cannot contain the zero code unit, as the first one seen marks the end of the string. The "length" of a string is the number of code units before the zero code unit. The memory occupied by a string is always one more code unit than the length, as space is needed to store the zero terminator. Generally, the term "string" means a string where the code unit is of type codice_1, which is exactly 8  bits on all modern machines. C90 defines "wide strings" which use a code unit of type codice_2, which is 16 or 32 bits on modern machines. This was intended for Unicode but it is increasingly common to use UTF-8 in normal strings for Unicode instead. Strings are passed to functions by passing a pointer to the first code unit. Since codice_3 and codice_4 are different types, the functions that process wide strings are different than the ones processing normal strings and have different names. String literals (codice_5 in the C source code) are converted to arrays during compilation. The result  is an array of code units containing all the characters plus a trailing zero code unit. In C90 codice_6 produces a wide string. A string literal can contain the zero code unit (one way is to put codice_7 into the source), but this will cause the string to end at that point. The rest of the literal will be placed in memory (with another zero code unit added to the end) but it is impossible to know those code units were translated from the string literal, therefore such source code is "not" a string literal. Character encodings. Each string ends  at the first occurrence of the zero code unit of the appropriate kind (codice_1 or codice_2). Consequently, a byte string () can contain non-NUL characters in ASCII or any ASCII extension, but not characters in encodings such as UTF-16 (even though a 16-bit code unit might be nonzero, its high or low byte might be zero). The encodings that can be stored in wide strings are defined by the width of codice_2. In most implementations, codice_2 is at least 16 bits, and so all 16-bit encodings, such as UCS-2, can be stored. If codice_2 is 32-bits, then  32-bit encodings, such as UTF-32, can be stored. (The standard requires a "type that holds any wide character", which on Windows no longer holds true since the UCS-2 to UTF-16 shift.) C++11 and C11 add two types with explicit widths and . Variable-width encodings can be used in both byte strings and wide strings. String length and offsets are measured in bytes or codice_2, not in "characters", which can be confusing to beginning programmers. UTF-8 and Shift JIS are often used in C byte strings, while UTF-16 is often used in C wide strings when codice_2 is 16 bits . Truncating strings with variable length characters using functions like codice_15 can produce invalid sequences at the end of the string. This can be unsafe if the truncated parts are interpreted by code that assumes the input is valid. Support for Unicode literals such as (UTF-8) or (UTF-16 or UTF-32, depends on ) is implementation defined, and may require that the source code be in the same encoding, especially for where compilers might just copy whatever is between the quotes. Some compilers or editors will require entering all non-ASCII characters as codice_16 sequences for each byte of UTF-8, and/or codice_17 for  each word of UTF-16. Since C11 (and C++11), a new literal syntax is available that guarantees UTF-8 for a bytestring literal. Overview of functions. Most of the functions that operate on C strings are declared in the codice_18 header (codice_19 in C++), while functions that operate on C wide strings are declared in the codice_20 header (codice_21 in C++). These headers also contain declarations of functions used for handling memory buffers; the name is thus something of a misnomer. Functions declared in codice_18 are extremely popular since, as a part of the C standard library, they are guaranteed to work  on any platform which supports C. However, some security issues exist with these functions, such as potential buffer overflows when not used carefully and properly, causing the programmers to prefer safer and possibly less portable variants, out of which some popular ones are listed below. Some of these functions also violate const-correctness by accepting a codice_23 string pointer and returning a non-codice_23 pointer within the string. To correct this, some have been separated into two overloaded functions in the C++ version of the standard library. In historical documentation the term "character" was often used instead of "byte" for  C strings, which leads many to believe that these functions somehow do not work for UTF-8. In fact all lengths are defined as being in bytes and this is true in all implementations, and these functions work as well with UTF-8 as with single-byte encodings. The BSD documentation has been fixed to make this clear, but POSIX, Linux, and Windows documentation still uses "character" in many places where "byte" or "wchar_t" is the correct term. Functions for handling memory buffers can process sequences of bytes that include null-byte as part of the data. Names of these functions typically  start with codice_25, as opposite to the codice_26 prefix. Functions. Multibyte functions. These functions all take a pointer to a object that the caller must maintain. This was originally intended to track shift states in the encodings, but modern ones such as UTF-8 do not need this. However these functions were designed on the assumption that the encoding is not a variable-width encoding and thus are designed to deal with exactly one at a time, passing it by value rather than using a string pointer. As UTF-16 is a variable-width encoding, the has been reused to keep track  of surrogate pairs in the wide encoding, though the caller must still detect and call twice for a single character. Numeric conversions. The C standard library contains several functions for numeric conversions. The functions that deal with byte strings are defined in the codice_27 header (codice_28 header in C++). The functions that deal with wide strings are defined in the codice_20 header (codice_21 header in C++). The codice_31 functions are not const-correct, since they accept a codice_23 string pointer and return a non-codice_23 pointer within the string. Also, since the Normative Amendment 1 (C95), codice_34 functions are considered  subsumed by codice_31 functions, for which reason neither C95 nor any later standard provides wide-character versions of these functions. The argument against codice_34 is that they do not differentiate between an error and a codice_37. Replacements. Despite the well-established need to replace codice_38 and codice_39 with functions that do not allow buffer overflows, no accepted standard has arisen. This is partly due to the mistaken belief by many C programmers that codice_40 and codice_15 have the desired behavior; however, neither function was designed for this (they were intended to manipulate null-padded fixed-size string buffers, a data  format less commonly used in modern software), and the behavior and arguments are non-intuitive and often written incorrectly even by expert programmers. The most popular replacement are the codice_42 and codice_43 functions, which appeared in OpenBSD 2.4 in December, 1998. These functions always write one NUL to the destination buffer, truncating the result if necessary, and return the size of buffer that would be needed, which allows detection of the truncation and provides a size for creating a new buffer that will not truncate. They have been criticized on the basis of allegedly being inefficient, encouraging the use of  C strings (instead of some superior alternative form of string), and hiding other potential errors. Consequently, they have not been included in the GNU C library (used by software on Linux), although they are implemented in the C libraries for OpenBSD, FreeBSD, NetBSD, Solaris, OS X, and QNX, as well as in alternative C libraries for Linux, such as musl introduced in 2011. The lack of GNU C library support has not stopped various software authors from using it and bundling a replacement, among other SDL, GLib, ffmpeg, rsync, and even internally in the Linux kernel. Open source implementations for  these functions are available. Sometimes codice_44 or codice_45 are used, as they may be more efficient than codice_39 as they do not repeatedly check for NUL (this is less true on modern processors). Since they need a buffer length as a parameter, correct setting of this parameter can avoid buffer overflows. As part of its 2004 Security Development Lifecycle, Microsoft introduced a family of "secure" functions including codice_47 and codice_48 (along with many others). These functions were standardized with some minor changes as part of the optional C11 (Annex K) proposed by ISO/IEC WDTR 24731. These functions perform various  checks including whether the string is too long to fit in the buffer. If the checks fail, a user-specified "runtime-constraint handler" function is called, which usually aborts the program. Some functions perform destructive operations before calling the runtime-constraint handler; for example, codice_48 sets the destination to the empty string, which can make it difficult to recover from error conditions or debug them. These functions attracted considerable criticism because initially they were implemented only on Windows and at the same time warning messages started to be produced by Microsoft Visual C++ suggesting the programmers to use these functions  instead of standard ones. This has been speculated by some to be an attempt by Microsoft to lock developers into its platform. Although open-source implementations of these functions are available, these functions are not present in common Unix C libraries. Experience with these functions has shown significant problems with their adoption and errors in usage, so the removal of Annex K is proposed for the next revision of the C standard. Usage of has also been suggested as a way to avoid unwanted compiler optimizations.