Page History

The C99 standard \[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] introduces flexible array members into the language. While flexible array members are a useful addition they shouldneed to be properly understood and used with care. 

The following is an example of a structure that contains a flexible array member,:

struct flexArrayStruct {
  int num;
  int data[];
};

This definition means that, when allocating storage space, only the first member, num, is considered. Consequently, the result of accessing the member data of a variable of type struct flexArrayStruct is undefined. DCL38-C. Use the correct syntax when declaring flexible array members describes the correct way to declare a struct with a flexible array member.

To avoid the potential for undefined behavior, structures that contain a flexible array member should always be accessed with a pointer as shown in the following code example.

struct flexArrayStruct *structP;
size_t array_size;
size_t i;

/* Initialize array_size */

/* Space is allocated for the struct */
structP = (struct flexArrayStruct *)
   malloc(sizeof(struct flexArrayStruct) + sizeof(int) * array_size);
if (structP == NULL) {
  /* Handle malloc failure */
}

structP->num = 0;

/*
 * Access data[] as if it had been allocated
 * as data[array_size]
 */
for (i = 0; i < array_size; i++) {
  structP->data[i] = 1;
}

Noncompliant Code Example (Declaration)

dynamically allocated and operated on.

Noncompliant Code Example (Storage Allocation)

This noncompliant code example statically allocates storage for a structure containing a flexible array memberWhen using structures with a flexible array member you should never directly declare an instance of the structure.  In this noncompliant code, a variable of type struct flexArrayStruct is declared.

struct flexArrayStruct flexStruct;
size_t array_size;
size_t i;

/* Initialize array_size */

/* Initialize structure */
flexStruct.num = 0;

for (i = 0; i < array_size; i++) {
  flexStruct.data[i] = 0;
}

The problem with this code is that the {{flexArrayStruct}} does not actually reserve space for the integer array data - it can't as the size hasn't been specified.  Consequently, while initializing the {{num}} member to zero is allowed, attempting to write even one value into data (that is, {{data\[0\]}}) willis likely to overwrite memory outside notof the ownedbounds byof the structureobject.

Compliant Code Example (

...

Storage Allocation)

The solution is to always declare pointers to structures containing a flexible array member and dynamically allocate memory for them.  The following code snippet illustrates thisThis compliant solution dynamically allocates storage for struct flexArrayStruct.

struct flexArrayStruct *flexStruct;
size_t array_size;
size_t i;

/* Initialize array_size */

/* Dynamically allocate memory for the structure */
flexStruct = (struct flexArrayStruct *)malloc(
   malloc(sizeof(struct flexArrayStruct) + sizeof(int) * array_size
);
if (flexStruct == NULL) {
  /* Handle malloc failure */
}

/* Initialize structure */
flexStruct->num = 0;

for (i = 0; i < array_size; i++) {
  flexStruct->data[i] = 0;
}

In this code snippet the resolves the issue by declaring a pointer to {{flexArrayStruct}} and then dynamically allocating memory for the pointer to point to.  In this case it is acceptable to access the elements of the {{data\[\]}} memberThe {{data\[\]}} member of {{flexStruct}} can now be accessed as described in C99 Section 6.7.2.1, paragraph 16.

Noncompliant Code Example (Copying)

When using structures with a flexible array member you should never directly copy an instance of the structure.   This noncompliant code attempts to replicate a copy of struct flexArrayStruct.

struct flexArrayStruct *flexStructA;
struct flexArrayStruct *flexStructB;
size_t array_size;
size_t i;

/* Initialize array_size */

/* Allocate memory for flexStructA */

/* Allocate memory for flexStructB */

/* Initialize flexStructA */

/* ... */

*flexStructB = *flexStructA;

The problem with this noncompliant code example is that when the structure is copied the size of the flexible array member is not considered and only the first member of the structure, num, is copied.

Compliant Solution (Copying)

This compliant solution uses memcpy() to properly copy the content of flexStructA into flexStructB.

...

In this case the copy is explicit and the flexible array member is accounted for and copied as well.

Noncompliant Code Example (

...

Function Arguments)

When using structures with a flexible array member you should never directly pass an instance of the structure in a function call.  In this noncompliant code, the flexible array structure is passed directly to a function which tries to print the array elements.

void print_array(struct flexArrayStruct structP) {
  size_t i;

  printf("Array is: ");
  for (i = 0; i < structP.num; i++) {
    printf("%d", structP.data[i]);
  }
  printf("\n");
}

struct flexArrayStruct *structP;
size_t array_size;
size_t i;

/* initialize array_size */

/* space is allocated for the struct */
structP = (struct flexArrayStruct *)malloc(
     malloc(sizeof(struct flexArrayStruct) + sizeof(int) * array_size
);
if (structP == NULL) {
  /* Handle malloc failure */
}

structP->num = array_size;

for (i = 0; i < array_size; i++) {
  structP->data[i] = i;
}

print_array(*structP);

The problem with this code is that passing the structure directly to the function actually makes a copy of the structure.   This copied fails for the same reason as the copy example above.

Compliant Solution (

...

Function Arguments)

Never allow a structure with a flexible array member to be passed directly in a function call.   The above code can be fixed by changing the function to accept a pointer to the structure.

void print_array(struct flexArrayStruct *structP) {
  size_t i;

  printf("Array is: ");
  for (i = 0; i < structP->num; i++) {
    printf("%d", structP->data[i]);
  }
  printfputs("\n");
}

struct flexArrayStruct *structP;
size_t array_size;
size_t i;

/* initialize array_size */

/* space is allocated for the struct */
structP = (struct flexArrayStruct *)malloc(
     malloc(sizeof(struct flexArrayStruct) + sizeof(int) * array_size
);
if (structP == NULL) {
  /* Handle malloc failure */
}

structP->num = array_size;

for (i = 0; i < array_size; i++) {
  structP->data[i] = i;
}

print_array(structP);

Risk Assessment

Failure to use structures with flexible array members correctly can result in undefined behavior.

Automated Detection

Compass/ROSE can detect some violations of this rule.  In particular, it warns if the last element of a struct is an array with a small index (0 or 1).

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\]
\[[JTC1/SC22/WG14 N791|http://www.open-std.org/jtc1/sc22/wg14/www/docs/n791.htm]\]

...