| Wiki Markup |
|---|
Calling a function with incorrect arguments can result in unexpected or unintended program behavior. Functions that are appropriately declared \[[DCL07-A. Include the appropriate type information in function declarators]\] will typically fail compilation if they are supplied with the wrong number or types of arguments. However, there are cases where supplying the incorrect arguments to a function will only generate compiler warnings. These warnings should be resolved \[[MSC00-A. Compile cleanly at high warning levels]\], but do not prevent program compilation. |
Non-Compliant Code Example: (function pointers)
In this example, the function pointer fp is used to refer to the function strchr(). However, fp is defined without the appropriate parameter list. As a result there is no type checking performed on the call to fp(12,2);.
...
| Wiki Markup |
|---|
Note that this example violates recommendation \[[DCL35-C. Do not convert a function pointer to a function of an incompatible type]\]. |
Compliant Solution: (function pointers)
Properly declaring fp so it is compatible with strchr() corrects this example.
| Code Block | ||
|---|---|---|
| ||
#include <string.h>
char *(*fp) (const char *,int);
int main(void) {
char *c;
fp = strchr;
c = fp("Hello",'H');
printf("%s\n",c);
}
|
Non-Compliant Code Example: (variadic functions)
| Wiki Markup |
|---|
The POSIX function {{open()}} \[[Open Group 04|AA. C References#Open Group 04]\] is a variadic function with the following prototype: |
...
| Code Block | ||
|---|---|---|
| ||
/* ... */
int fd = open(file_name, O_CREAT | O_WRONLY); /* access permissions are missing */
if (fd == -1){
/* Handle Error */
}
/* ... */
|
Compliant Solution: (variadic functions)
To correct this example, a third argument is specified in the call to open().
| Code Block | ||
|---|---|---|
| ||
/* ... */
int fd = open(file_name, O_CREAT | O_WRONLY, file_access_permissions);
if (fd == -1){
/* Handle Error */
}
/* ... */
|
Risk Assessment
Calling a function with incorrect arguments can result in unexpected or unintended program behavior.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXPXX-C | 1 (low) | 1 (unlikely) | 3 (low) | P3 | L3 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[ISO/IEC 9899-1999:TC2|AA. C References#ISO/IEC 9899-1999TC2]\] Forward, Section 6.9.1, "Function definitions" \[[Spinellis 06|AA. C References#Spinellis 06]\] Section 2.6.1, "Incorrect Routine or Arguments" |