...
To avoid the potential for undefined behavior, structures that contain a flexible array member should always be allocated and operated on dynamically. Flexible array structures should not be:
- declared on the stack; they should be on the heap.
- copied via assignment; they should be copied using
memcpy()or a similar function. - passed as raw arguments to functions; should be passed as a pointer instead.
Noncompliant Code Example (Storage Allocation)
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
struct flexArrayStruct { int num; int data[]; }; void func(void) { struct flexArrayStruct flexStruct; size_t array_size; size_t i = 4; /* Initialize array_size */ /* Initialize structure */ flexStruct.num = 0array_size; for (size_t i = 0; i < array_size; i++) { flexStruct.data[i] = 0; } } |
The problem with this code is that the flexArrayStruct does not actually reserve space for the integer array data; it can't because the size is not specified. Consequently, although initializing the num member to zero is allowed, attempting to write even one value into data (that is, data[0]) is likely to overwrite memory outside of the object's bounds.
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stdlib.h> struct flexArrayStruct { int num; int data[]; }; void func(void) { struct flexArrayStruct *flexStruct; size_t array_size; size_t i = 4; /* Initialize array_size */ /* Dynamically allocate memory for the structure. */ flexStruct = (struct flexArrayStruct *)malloc( sizeof(struct flexArrayStruct) + sizeof(int) * array_size ); if (flexStruct == NULL) { /* Handle malloc failureerror */ } /* Initialize structure */ flexStruct->num = 0array_size; for (size_t i = 0; i < array_size; i++) { flexStruct->data[i] = 0; } } |
The data[] member of flexStruct can now be accessed as described in the C Standard, Section subclause 6.7.2.1, paragraph 18 [ISO/IEC 9899:2011].
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
struct flexArrayStruct *flexStructA;{ struct flexArrayStructint *flexStructBnum; size_t array_size; size_t i; /* Initialize array_size */ /* Allocate memory for flexStructA */ /* Allocate memory for flexStructB */ /* Initialize flexStructA */ /* ... */ * int data[]; }; void func(struct flexArrayStruct *structA, struct flexArrayStruct *structB) { *flexStructB = *flexStructA; } |
The problem with this noncompliant code example is that when the structure is copied, the size of the flexible array member is not considered, and only the first member of the structure, num, is copied.
...
This compliant solution uses memcpy() to properly copy the content of flexStructA of structA into flexStructB structB:
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <string.h> struct flexArrayStruct *flexStructA;{ struct flexArrayStructint *flexStructBnum; size_t array_size; size_t i; /* Initialize array_size */ /* Allocate memory for flexStructA */ /* Allocate memory for flexStructB */ /* Initialize flexStructA */ /* ... */ memcpy( flexStructB, flexStructA, ( int data[]; }; void func(struct flexArrayStruct *structA, struct flexArrayStruct *structB) { memcpy(structB, structA, sizeof(struct flexArrayStruct) + (sizeof(int) * array_size) ); } |
This compliant solution ensures that the entire structure, including the flexible array member, is copied correctly.
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stdio.h> #include <stdlib.h> struct flexArrayStruct { int num; int data[]; }; void print_array(struct flexArrayStruct structP) { size_t i; puts("Array is: "); for (size_t i = 0; i < structP.num; i++) { printf("%d", structP.data[i]); } puts("\n"); } void func(void) { struct flexArrayStruct *structP; size_t array_size; size_t i = 4; /* initialize array_size */ /* spaceSpace is allocated for the struct. */ structP = (struct flexArrayStruct *)malloc( sizeof(struct flexArrayStruct) + sizeof(int) * array_size ); if (structP == NULL) { /* Handle malloc failureerror */ } structP->num = array_size; for (size_t i = 0; i < array_size; i++) { structP->data[i] = i; } print_array(*structP); } |
Because C passes the argument by value, the structure is copied onto the stack. The size of the flexible array member is not considered when the structure is copied, and only the first member of the structure, num, is copied.
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stdio.h> #include <stdlib.h> struct flexArrayStruct { int num; int data[]; }; void print_array(struct flexArrayStruct *structP) { size_t i; puts("Array is: "); for (size_t i = 0; i < structP->num; i++) { printf("%d", structP->data[i]); } puts("\n"); } void func(void) { struct flexArrayStruct *structP; size_t array_size; size_t i = 4; /* initialize array_size */ /* spaceSpace is allocated for the struct. */ structP = (struct flexArrayStruct *)malloc( sizeof(struct flexArrayStruct) + sizeof(int) * array_size ); if (structP == NULL) { /* Handle malloc failureerror */ } structP->num = array_size; for (size_t i = 0; i < array_size; i++) { structP->data[i] = i; } print_array(structP); } |
Risk Assessment
Failure to use structures with flexible array members correctly can result in undefined behavior.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MEM33-C | low | unlikely | low | P3 | L3 |
Automated Detection
Flexible array structs should not be
...
...
Tool | Version | Checker | Description |
|---|---|---|---|
ROSE |
|
| Can detect all of these |
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Bibliography
| [ISO/IEC 9899:2011] | Section Subclause 6.7.2.1, "Structure and Union Specifiers" |
| [JTC1/SC22/WG14 N791] |
...