The use of incomplete class declarations (also known as "forward" declarations) is common. While it is possible to declare pointers and references to incomplete classes, because the class definition is not available it is not possible to access a member of the class, determine the size of the class object, and so on. However, it is possible to cast and delete a pointer to an incomplete class, but this is never a good idea.
Non-Compliant Code Example (deleting)
Consider a common application of a handle/body idiom that implements an abstract data type by a handle that contains a pointer to an implementation class.
...
Because impl_
is a pointer to an undefined class, its deletion in Handle
's destructor results in undefined behavior if Body
has a non-trivial destructor. Even in the case where Body
does have a trivial destructor, this practice should be avoided. During maintenance a non-trivial destructor could be added to Body
, resulting in undefined behavior in the destructor for Handle
. Typical behavior in this case is that no destructor is called and the memory for Body
is released via a call to the usual global operator delete
. This may result in a resource leak or other bug if the destructor manages resources, or if the definition of Body
defines or inherits a member operator delete
.
Compliant Solution 1
The deletion of impl_
should be moved to a part of the code where Body
is defined.
Code Block | ||
---|---|---|
| ||
class Body { ... }; Handle::~Handle() { delete impl_; } // correct. |
Compliant Solution 2
Alternatively, an appropriate smart pointer may be used in place of a raw pointer.
...
Note that we used a shared_ptr
to refer to the Body
. Other common smart pointers, including std::auto_ptr
, will still produce undefined behavior.
Non-Compliant Code Example (casting)
Similarly, while it is possible to cast a pointer or reference to an incomplete class, it is never a good idea to do so. Casting a class address often involves an adjustment of the address by a fixed amount that can only be determined after the layout and inheritance structure of the class is known, and this information is not available in the case of an incomplete class.
...
In the case of an old-style cast, the address adjustment will, however, take place if the cast is performed at a point where the structure of the class D
is known. This different, context-dependent behavior of the old-style cast can result in very challenging bugs.
Compliant Solution
Avoid casting to or from pointers to incomplete classes. If such a cast is, for some reason, absolutely necessary, prefer reinterpret_cast
to an old-style cast because it will exhibit the same behavior whether or not the class is incomplete.
Risk Assessment
Casting pointers or references to incomplete classes can result in bad addresses. Deleting a pointer to an incomplete class results in undefined behavior if the class has a non-trivial destructor. This can result in program termination, a runtime signal, or resource leaks.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
EXP36-C | 2 (medium) | 1 (unlikely) | 2 (medium) | P4 | L3 |
References
Wiki Markup |
---|
\[[Dewhurst 03|AA. C++ References#Dewhurst 04]\] Gotcha 39: Casting Incomplete Types |