C library functions that make changes to arrays or objects usually take at least two arguments: i.) a pointer to the array/object ii.) an integer indicating the number of elements or bytes to be manipulated. If the arguments are supplied improperly during such a function call, the function may cause the pointer to not point to the object at all or point past the end of the object. This would lead to undefined behavior.
To make sure that this does not happen, programmers must keep in mind the following rules when using such functions:
- For func (p,n), where 'p' is the pointer, 'n' is the integer and 'func' is the library function, the value of ânâ should not be greater than the effective size of the pointer. Also, the effective type of the pointer should be compatible with either the derived type of 'n' or unsigned char.
- For func (p,q, n), where 'p' and 'q' are both pointers, 'n' is the integer and 'func' is the library function, the value of ânâ should not be greater than the effective size of any of the two pointers ('p' and 'q'). The effective type of the 'p' should be compatible with the derived type of 'n' or unsigned char. Similarly, the effective type of the 'p' should be compatible with the effective type of 'q' or unsigned char.
- For expression E of the form: T* q = func (n), where 'func' is a memory allocation function, the value of 'n' should not be less than sizeof (T). Also, the effective type of 'T' should be compatible with either the derived type of 'n' or unsigned char.
| Wiki Markup |
|---|
According to the WG14 document \[1\]: |
Given an integer expression E, the derived type T of E is determined as follows:
...
- The first rule from the above definition is applied to non-compliant code/compliant solution 2 and 4 in this page to calculate the derived type of expression 'n' is those examples.
Effective size of of a pointer is the size of the object to which it points.
...
The effective size of the pointer 'p' in this example will be sizeof(arr) i.e. 5*sizeof(int).
Effective type of of an object is defined as either its declared type or (in case its type hasn't been declared) the effective type of the value assigned to it. In the examples below, we have used terms like 'effective type of pointer p' which implies that if the type of 'p' has been declared (eg: char *p) then that type (in this case char) is the effective type of the pointer. If the type is not declared (eg: void *p) and then the pointer is assigned a value (p = obj), then the effective type of 'p' is the effective type of 'obj'.
C library functions that make changes to arrays or objects usually take at least two arguments: i.) a pointer to the array/object ii.) an integer indicating the number of elements or bytes to be manipulated. If the arguments are supplied improperly during such a function call, the function may cause the pointer to not point to the object at all or point past the end of the object. This would lead to undefined behavior.
To make sure that this does not happen, programmers must keep in mind the following rules when using such functions:
- For func (p,n), where 'p' is the pointer, 'n' is the integer and 'func' is the library function, the value of ânâ should not be greater than the effective size of the pointer. Also, the effective type of the pointer should be compatible with either the derived type of 'n' or unsigned char.
- For func (p,q, n), where 'p' and 'q' are both pointers, 'n' is the integer and 'func' is the library function, the value of ânâ should not be greater than the effective size of any of the two pointers ('p' and 'q'). The effective type of the 'p' should be compatible with the derived type of 'n' or unsigned char. Similarly, the effective type of the 'p' should be compatible with the effective type of 'q' or unsigned char.
- For expression E of the form: T* q = func (n), where 'func' is a memory allocation function, the value of 'n' should not be less than sizeof (T). Also, the effective type of 'T' should be compatible with either the derived type of 'n' or unsigned char.
Noncompliant Code Example
This noncompliant code example assigns a value greater than the size of dynamic memory to 'n' which is then passed to the memset().
...
| Code Block | ||
|---|---|---|
| ||
void f1 (size_t nchars, size_t val) {
char *p = (char *)malloc(nchars);
const size_t n = val;
if (nchars < n) {
    /* Handle Error */
}
else {
memset(p, 0, n);
}
}
|
Noncompliant Code Example
In noncompliant code example the effective type of *p is float while the derived type of the expression 'n' is int.
...
Note: A possibility of this code being safe would be on architectures where sizeof (int) is equal to sizeof (float).
Compliant Solution
The In this compliant solution, the derived type of 'n' in this solution is also float .(since it is a sizeof expression and therefore the derived is the type of the operand, which is float; see derived type above)
| Code Block | ||
|---|---|---|
| ||
void f2() {
const size_t ARR_SIZE = 4;
float a[ARR_SIZE];
const size_t n = sizeof(float) * ARR_SIZE;
void *p = a;
memset(p, 0, n);
/* More program code */
}
|
Noncompliant Code Example
In this noncompliant code example, the size of 'n' could be greater than the size of *p. Also, the effective type of *p (int) is not same as the effective type of *q (float).
...
| Code Block | ||
|---|---|---|
| ||
void f3(float *a, size_t val) {
float b = 3.14;
const size_t n = val;
void *p = a;
void *q = &b;
if( (n > sizeof(a)) || (n > sizeof(b)) ) {
/* Handle error */
}
else {
memcpy(p, q, n);
/* More program code */
}
}
|
Noncompliant Code Example
In this noncompliant code example, the value of 'n' is greater than the size of 'T' i.e. sizeof (wchar_t). But, the derived type of expression 'n' (wchar_t *) is not same as the type of 'T' i.e. because its derived type (from the definition above; see derived type) will be equal to the type of 'p', which is wchar_t *.
| Code Block | ||
|---|---|---|
| ||
wchar_t *f7() {
const wchar_t *p = L"Hello, World!";
const size_t n = sizeof(p) * (wcslen(p) + 1);
wchar_t *q = (wchar_t *)malloc(n);
return q;
}
|
...