Page History

...

To avoid the potential for undefined behavior, structures that contain a flexible array member should always be dynamically allocated and operated on.

Noncompliant Code Example (Storage Allocation)

This noncompliant code example statically allocates storage for a structure containing a flexible array member.

...

The problem with this code is that the {{flexArrayStruct}} does not actually reserve space for the integer array data - it can't as the size hasn't been specified. Consequently, while initializing the {{num}} member to zero is allowed, attempting to write even one value into data (that is, {{data\[0\]}}) is likely to overwrite memory outside of the bounds of the object.

Compliant Code Example (Storage Allocation)

This compliant solution dynamically allocates storage for struct flexArrayStruct.

...

The {{data\[\]}} member of {{flexStruct}} can now be accessed as described in C99 Section 6.7.2.1, paragraph 16.

Noncompliant Code Example (Copying)

This noncompliant code attempts to copy an instance of a structure containing a flexible array member (struct flexArrayStruct) by assignment.

...

The problem with this noncompliant code example is that when the structure is copied the size of the flexible array member is not considered and only the first member of the structure, num, is copied.

Compliant Solution (Copying)

This compliant solution uses memcpy() to properly copy the content of flexStructA into flexStructB.

...

This compliant solutions ensures that the entire structure, including the flexible array member, is correctly copied.

Noncompliant Code Example (Function Arguments)

In this noncompliant code, the flexible array structure is passed directly to a function which tries to print the array elements.

...

Because C passes the argument by value, a the structure is copied onto the stack. The size of the flexible array member is not considered when the structure is copied and only the first member of the structure, num, is copied.

Compliant Solution (Function Arguments)

In this compliant solution, the {{print_array()}}function accepts a pointer to the structure and not .

void print_array(struct flexArrayStruct *structP) {
  size_t i;

  puts("Array is: ");
  for (i = 0; i < structP->num; i++) {
    printf("%d", structP->data[i]);
  }
  puts("\n");
}

struct flexArrayStruct *structP;
size_t array_size;
size_t i;

/* initialize array_size */

/* space is allocated for the struct */
structP = (struct flexArrayStruct *)malloc(
  sizeof(struct flexArrayStruct) + sizeof(int) * array_size
);
if (structP == NULL) {
  /* Handle malloc failure */
}

structP->num = array_size;

for (i = 0; i < array_size; i++) {
  structP->data[i] = i;
}

print_array(structP);

Risk Assessment

Failure to use structures with flexible array members correctly can result in undefined behavior.

Automated Detection

Compass/ROSE can detect some violations of this rule.  In particular, it warns if the last element of a struct is an array with a small index (0 or 1).

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\]
\[[JTC1/SC22/WG14 N791|http://www.open-std.org/jtc1/sc22/wg14/www/docs/n791.htm]\]

...