Page History

...

Compliance with this rule is complicated by the fact that the char data type might, in any implementation, be signed or unsigned.

Non-Compliant Code Example

This non-compliant code example may pass invalid values to the isspace() function.

size_t count_whitespace(const char *s) {
  const char *t = s;
  while (isspace(*t))  /* possibly *t < 0 */
    ++t;
  return t - s;
}

Compliant Solution (Unsigned Char)

Pass character strings around explicitly using unsigned characters.

...

This approach is inconvenient when you need to interwork with other functions that haven't been designed with this approach in mind, such as the string handling functions found in the standard library \[[Kettlewell 02|AA. C References#Kettlewell 02]\].

Compliant Solution (Cast)

This compliant solution uses a cast.

size_t count_whitespace(const char *s) {
  const char *t = s;
  while (isspace((unsigned char)*t))
    ++t;
  return t - s;
}

Risk Assessment

Passing values to character handling functions that cannot be represented as an unsigned char may result in unintended program behavior.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.4, "Character handling <ctype.h>"
\[[Kettlewell 02|AA. C References#Kettle 02]\] Section 1.1, "<ctype.h> And Characters Types"

...

INT36INT33-C. Do not shift a negative number of bits or more bits than exist in the operandEnsure that division and modulo operations do not result in divide-by-zero errors      04. Integers (INT)       05. Floating Point (FLP) INT35-C. Evaluate integer expressions in a larger size before comparing or assigning to that size