...
| Code Block | ||||
|---|---|---|---|---|
| ||||
void func(size_t size) {
int vla[size];
/* ... */
}
/* ... */
|
However, it is not guaranteed that the value of size is a valid size argument, potentially giving rise to a security vulnerability.
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
enum { MAX_ARRAY = 1024 };
void func(size_t size) {
if (0 < size && size < MAX_ARRAY) {
int vla[size];
/* ... */
} else {
/* Use dynamic allocation. */
}
}
/* ... */
|
Implementation Details
Microsoft
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| CERT C Secure Coding Standard | INT01-C. Use rsize_t or size_t for all integer values representing the size of an object |
| ISO/IEC TR 24772:2013 | Unchecked Array Indexing [XYZ] |
| ISO/IEC TS 17961 (Draft) | Tainted, potentially mutilated, or out-of-domain integer values are used in a restricted sink [taintsink] |
Bibliography
| [ISO/IEC 9899:2011] | Annex J, J.2, "Undefined behavior" |
| [Griffiths 2006] |
...