Add guidance for strlen rule

guidance/DS140021.md

@@ -0,0 +1,26 @@
+# Banned C function detected (strlen)
+
+## Summary
+
+* Use of the `strlen` function to determine the length of a string can lead to a buffer overrun vulnerability.
+* Use secure versions such as `strlen_s` or `strnlen` to help prevent buffer overruns.
+
+## Details
+
+The `strlen` function counts characters until the null terminator is encountered.
+When a string is missing the null terminator, the resulting value returned is larger than the string.
+Code that relies on the result of `strlen` can suffer from a buffer overrun vulnerability.
+
+## Severity Considerations
+
+In the worst case, a buffer overrun vulnerability can provide an attacker the ability to execute arbitrary code leading to complete system compromise.
+
+## Solution
+
+Use secure versions such as `strlen_s` or `strnlen` to help prevent buffer overruns. See [Microsoft C Runtime Reference: strnlen](https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strnlen-strnlen-s) for more information.
+
+## References
+
+* [Avoiding Buffer Overruns](https://learn.microsoft.com/en-us/windows/win32/SecBP/avoiding-buffer-overruns)
+* [Microsoft C Runtime Reference: strlen](https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strlen-wcslen-mbslen-mbslen-l-mbstrlen-mbstrlen-l)
+* [Microsoft C Runtime Reference: strnlen](https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strnlen-strnlen-s)