...
Every program shall contain exactly one definition of every non-inline function or object that is used in that program; no diagnostic required.
Although it is possible to check that the ODR is complied with (see \[ [Quinlan 06|AA. Bibliography#Quinlan 06]\]), as of October 2006 we are not aware of any compilers that fully enforce the rule or even issue a diagnostic. The EDG [C++ Front End|https://www.edg.com/index.php?location=c_frontend] diagnoses a subset of violations of the ODR when compiling in export mode (a mode where the C++ {{ Wiki Markup export
}} feature is enabled). As the paper by Quinlan et al. shows, failing to enforce the ODR enables a virtual function pointer attack, known as the VPTR [exploit|BB. Definitions#exploit]. This is where an object's virtual function table is corrupted so that calling a virtual function on the object results in malicious code being executed. See the paper by Quinlan et al. for more details.
Non-Compliant Code Example
...
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
MSC33-CPP | high | unlikely | high | P3 | L3 |
Bibliography
\[[ISO/IEC 14882-2003|AA. Bibliography#ISO/IEC 14882-2003]\] Section 3.2, "One definition rule" Wiki Markup
\[[Quinlan 06|AA. Bibliography#Quinlan 06]\] Wiki Markup
...
MSC32-CPP. Ensure your random number generator is properly seeded 49. Miscellaneous (MSC) MSC34-CPP. Do not modify the standard namespace