Page History

Weak typing in C allows type casting memory to different types. Because the internal representation of most types is system dependent, applying operations intended for data of one type to data of a different type will likely yield non-portable code and produce unexpected results.

...

Noncompliant Code Example (Integers vs. Floating-Point Numbers)

The following non-compliant noncompliant code demonstrates the perils of operating on data of incompatible types. An attempt is made to increment an integer type cast to a floating point type, and a floating point cast to an integer type.

...

int is 0, float is 0.000000
int is 1065353216, float is 0.000000

Compliant Solution (Integers vs. Floating-Point Numbers)

In this compliant solution, the pointers are assigned to variables of compatible data types.

...

int is 0, float is 0.000000
int is 1, float is 1.000000

Bit-Fields

The internal representations of bit-field structures have several properties (such as internal padding) that are implementation-defined. Additionally, bit-field structures have several implementation-defined constraints:

...

Consequently, it is impossible to write portable safe code that makes assumptions regarding the layout of bit-field structure members.

...

Noncompliant Code Example (Bit-Field Alignment)

Bit-fields can be used to allow flags or other integer values with small ranges to be packed together to save storage space. Bit-fields can improve the storage efficiency of structures. Compilers typically allocate consecutive bit-field structure members into the same int-sized storage, as long as they fit completely into that storage unit. However, the order of allocation within a storage unit is implementation-defined. Some implementations are "right-to-left": the first member occupies the low-order position of the storage unit. Others are "left-to-right": the first member occupies the high-order position of the storage unit. Calculations that depend on the order of bits within a storage unit may produce different results on different implementations.

...

struct bf {
  unsigned int m1 : 8;
  unsigned int m2 : 8;
  unsigned int m3 : 8;
  unsigned int m4 : 8;
}; /* 32 bits total */

void function() {
  struct bf data;
  unsigned char *ptr;

  data.m1 = 0;
  data.m2 = 0;
  data.m3 = 0;
  data.m4 = 0;
  ptr = (unsigned char *)&data;
  (*ptr)++; /* can increment data.m1 or data.m4 */
}

Compliant Solution (Bit-Field Alignment)

This compliant solution is explicit in which fields it modifies.

struct bf {
  unsigned int m1 : 8;
  unsigned int m2 : 8;
  unsigned int m3 : 8;
  unsigned int m4 : 8;
}; /* 32 bits total */

void function() {
  struct bf data;
  data.m1 = 0;
  data.m2 = 0;
  data.m3 = 0;
  data.m4 = 0;
  data.m1++;
}

...

Noncompliant Code Example (Bit-Field Overlap)

In the following non-compliant noncompliant code, assuming eight bits to a byte, if bit-fields of six and four bits are declared, is each bit-field contained within a byte, or are the bit-fields split across multiple bytes?

...

If each bit-field lives within its own byte, then m2 (or m1, depending on alignment) is incremented by 1. If the bit-fields are indeed packed across 8-bit bytes, then m2 might be incremented by 4.

Compliant Solution (Bit-Field Overlap)

This compliant solution is explicit in which fields it modifies.

struct bf {
  unsigned int m1 : 6;
  unsigned int m2 : 4;
};

void function() {
  struct bf data;
  data.m1 = 0;
  data.m2 = 0;
  data.m2 += 1;
}

Automated Detection

Compass/ROSE can detect violations of this rule. Specifically, it reports violations if:

• A pointer to one object is typecast type cast to the pointer of a different object
• The pointed-to object of the (typecasttype cast) pointer is then modified arithmetically.

Risk Assessment

Making invalid assumptions about the type of type-cast data, especially bit-fields, can result in unexpected data values.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.7.2, "Type specifiers"
\[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "STR Bit Representations"
\[[MISRA 04|AA. C References#MISRA 04]\] Rule 3.5
\[[Plum 85|AA. C References#Plum 85]\] Rule 6-5

...

      03. Expressions (EXP)       EXP12-A. Do not ignore values returned by functions Image Added