...
UB | Description | Example Code |
|---|---|---|
Addition or subtraction of a pointer into, or just beyond, an array object and an integer type produces a result that does not point into, or just beyond, the same array object. | Forming Out-of-Bounds Pointer | |
Addition or subtraction of a pointer into, or just beyond, an array object and an integer type produces a result that points just beyond the array object and is used as the operand of a unary | ARR30-C. Do not form or use out of bounds pointers or array subscripts, ARR30-C. Do not form or use out of bounds pointers or array subscripts | |
An array subscript is out of range, even if an object is apparently accessible with the given subscript (as in the lvalue expression | ARR30-C. Do not form or use out of bounds pointers or array subscripts | |
An attempt is made to access, or generate a pointer to just past, a flexible array member of a structure when the referenced object provides no elements for that array. | ARR30-C. Do not form or use out of bounds pointers or array subscripts | |
The pointer passed to a library function array parameter does not have a value such that all address computations and object accesses are valid. |
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
enum { TABLESIZE = 100 };
static int table[TABLESIZE];
int * f(int index) {
if (index < TABLESIZE) {
return table + index;
}
return NULL;
}
|
Compliant Solution
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
enum { TABLESIZE = 100 };
static int table[TABLESIZE];
int * f(int index) {
if (0index <>= index0 && index < TABLESIZE) {
return table + index;
}
return NULL;
}
|
Compliant Solution
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stddef.h>
enum { TABLESIZE = 100 };
static int table[TABLESIZE];
int *f(size_t index) {
if (index < TABLESIZE) {
return table + index;
}
return NULL;
}
|
...
This compliant solution is for illustrative purposes and is not necessarily the solution implemented by Microsoft. This particular " solution " may not be correct because there is no guarantee that a backslash is found.
...
Second, when the index is greater than size, the function modifies size before growing the size of the buffer. If the call to realloc() fails to increase the size of the buffer, the next call to the function with a value of pos equal to or greater than the original value of size will again attempt to store value in a memory location just past the end of the buffer or beyond.
Third, the function violates INT30-C. Ensure that unsigned integer operations do not wrap when calculating the size of memory to allocate.
For a discussion of this programming error in the Common Weakness Enumeration database, see CWE-122, "For a discussion of this programming error in the Common Weakness Enumeration database, see CWE-122, "Heap-based buffer overflow," and CWE-129, "Improper validation of array index."
...
The following compliant solution correctly validates the index pos by using the <= operator and , ensures the multiplication will not overflow, and avoids modifying size until it has verified that the call to realloc() was successful:
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <realloc<stdint.h> #include <stdlib.h> static int *table = NULL; static size_t size = 0; int insert_in_table(size_t pos, int value) { if (size <= pos) { int *tmp = (int *)realloc(table, ; if ((pos + 1) > SIZE_MAX / sizeof(*table)) *{ return -1; } tmp = (int *)realloc(table, sizeof(*table) * (pos + 1)); if (tmp == NULL) { return -1; /* Failure */ } /* Modify size only after realloc succeeds */ size = pos + 1; table = tmp; } table[pos] = value; return 0; } |
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stddef<stdlib.h> struct S { size_t len; char buf[]; /* Flexible array member */ }; const char *find(const struct S *s, int c) { const char *first = s->buf; const char *last = s->buf + s->len; while (first++ != last) { /* Undefined behavior */ if (*first == (unsigned char)c) { return first; } } return NULL; } } |
Compliant Solution
void g(void) {
struct S *s = (struct S *)malloc(sizeof(struct S));
s->len = 0;
find(s, 'a');
} |
Compliant Solution
The The following compliant solution avoids incrementing the pointer unless a value past the pointer's current value is known to exist:
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stdlib.h> struct S { size_t len; char buf[]; /* Flexible array member */ }; const char *find(const struct S *s, int c) { const char *first = s->buf; const char *last = s->buf + s->len; while (first != last) { /* Avoid incrementing here */ if (*++first == (unsigned char)c) == (unsigned char)c) { return first; } } return NULL; } void g(void) { struct S *s return first= (struct S *)malloc(sizeof(struct S)); s->len = }0; } return NULLfind(s, 'a'); } |
| Anchor | ||||
|---|---|---|---|---|
|
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stddef.h>
#include <stdio.h>
void f(FILE *file) {
wchar_t wbuf[BUFSIZ];
const size_t size = sizeof(*wbuf);
const size_t nitems = sizeof(wbuf);
size_t nread;
nread = fread(wbuf, size, nitems, file);
}
|
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stddef.h>
#include <stdio.h>
void f(FILE *file) {
wchar_t wbuf[BUFSIZ];
const size_t size = sizeof(*wbuf);
const size_t nitems = sizeof(wbuf) / size;
size_t nread;
nread = fread(wbuf, size, nitems, file);
}
|
| Anchor | ||||
|---|---|---|---|---|
|
Noncompliant Code Example (Improper Scaling)
In this noncompliant example, the integer skip is scaled when added to the pointer s and may point outside the bounds of the object referenced by s:
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stddef.h>
#include <stdlib.h>
#include <string.h>
struct big {
unsigned long long ull_1;
unsigned long long ull_2;
unsigned long long ull_3;
int si_4;
int si_5;
};
int g(void) {
size_t skip = offsetof(struct big, ull_2);
struct big *s = (struct big *)malloc(4 * sizeof(struct big));
if (s == NULL) {
return -1; /* Failure */
}
memset(s + skip, 0, sizeof(struct big) - skip);
return 0;
}
|
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stddef.h>
#include <stdlib.h>
#include <string.h>
struct big {
unsigned long long ull_1;
unsigned long long ull_2;
unsigned long long ull_3;
int si_4;
int si_5;
};
int g(void) {
size_t skip = offsetof(struct big, ull_2);
struct big *s = (struct big *)malloc(4 * sizeof(struct big));
if (s == NULL) {
return -1; /* Failure */
}
memset(((unsigned char *)s) + skip, 0,
sizeof(struct big) - skip);
return 0;
} |
...