Page History

...

Given an integer expression E, the derived type T of E is determined as follows:

• if E is a sizeof expression, then T is the type of the operand of the expression;

• otherwise, if E is an integer identifier, then T is the derived type of the expression last used to store a value in E;

• otherwise, if the derived type of each of E's subexpressions is the same, then T is that type;

• otherwise, the derived type is an unspecified character type compatible with any of char, signed char,  and and unsigned char.

Example:          int val;

      {{               {{int arr \[ARR_SIZE\];}}

                              size_t c1 = sizeof (val);

                              size_t c2 =sizeof (arr) / sizeof (val);

                              size_t c3 = sizeof (arr) / sizeof (*arr);

...

The effective size of a pointer is the size of the object to which it points.

{{                    {{int arr\[5\];}}

                             int *p = arr;

The effective size of the pointer p in this example is sizeof(arr)---, that is, 5*sizeof(int).

The effective type of an object is defined as either its declared type or (if its type isn't declared) the effective type of the value assigned to it.

                            char *p;

The effective type of pointer p in this case is char.

                            void *p;

                            p = obj;

In this case, pointer p's type is not declared, but it is later assigned obj. The effective type of p is therefore equal to the effective type of obj.

...

C library functions that make changes to arrays or objects usually take at least two arguments: a pointer to the array or object and an integer indicating the number of elements or bytes to be manipulated. If the arguments are supplied improperly during such a function call, the function may cause the pointer to not point to the object at all or to point past the end of the object, leading to undefined behavior. 

To make sure this does not happen, programmers must keep in mind the following rules when using such functions:

...

In this noncompliant code example, the value of {{n}} is greater than the size of {{T}}\---, that is, {{sizeof(wchar_t)}}. But the derived type of expression {{n}} ({{wchar_t *}}) is not same as the type of {{T}} because its derived type (see Definitions section) will be equal to the type of {{p}}, which is {{wchar_t *}}. The derived type of {{n}} is calculated using the first rule from the WG14 Document's \[1\] definition of derived types (see Definitions section). Because {{n}} here is a {{sizeof}} expression, its derived type is equal to the type of the operand ({{p}}), which is {{wchar_t *}}.

...

Depending on the library function called, the attacker may be able to use a heap overflow vulnerability to run arbitrary code. The detection of checks specified in description the introduction can be automated, but the remediation has to be manual.

...