Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

If a function is reentered during the initialization of a static object inside that function, the behavior of the program is undefined. Please note that this is a different problem is not the same as infinite recursion. For this problem to occur, a function only needs to recurse once.

Wiki Markup
\[[ISO/IEC 14882-2003|AA. C++ References#ISO/IEC 14882-2003]\] Section 36.87, "ObjectDeclaration LifetimeStatement" describes athe numberinitialization of situations in which trying to access an object outside of its lifetime leads to undefined behavior.
Attempting to access an object outside of its lifetime can result in an exploitable vulnerability
static and thread storage duration objects.  In the case of static objects, recursive reentry into the initialization of a static storage duration causes undefined behavior and various results can be obtained when using different compilers.

Noncompliant Code Example

...

This noncompliant code example declares the variable p y as a pointer to a constant char with file scopestatic int. The value of str test(error) is assigned to p y within the dont_do_thistest() function. However, str has automatic storage duration, so the lifetime of str ends when the dont_do_this() function exitswhen test() is called with an input which results in reaching the initialization of y more than once, such as the value 12, undefined behavior occurs. Note that this code does not present an infinite recursion and still causes the undefined behavior mentioned.

Code Block
bgColor#FFCCCC
constint char *p;
void dont_do_this(void) {
    const char str[] = "This will change";test(int x){
  x--;
  if(x < 0 || x > 10)
  {
    preturn = str0;
 /* dangerous */ }
    /* ... */
}

void innocuous(void)else
  {
    conststatic charint str[]y = "Surprise, surprise";
}
/* ... */
dont_do_this();
innocuous();
/* p might be pointing to "Surprise, surprise" */test(x);  //<--undefined behavior occurs here
    return y;
  }
}

As a result of this undefined behavior, it is likely that p will refer to the string literal "Surprise, surprise" after the call to the innocuous() function.

...