Page History

The C Standard identifies the following distinct situations in which undefined behavior (UB) can arise as a result of invalid pointer operations:

UB	Description	Example Code
46	Addition or subtraction of a pointer into, or just beyond, an array object and an integer type produces a result that does not point into, or just beyond, the same array object.	Forming Out-of-Bounds Pointer, Null Pointer Arithmetic
47	Addition or subtraction of a pointer into, or just beyond, an array object and an integer type produces a result that points just beyond the array object and is used as the operand of a unary `*` operator that is evaluated.	Dereferencing Past the End Pointer, Using Past the End Index
49	An array subscript is out of range, even if an object is apparently accessible with the given subscript, for example, in the lvalue expression `a[1][7]` given the declaration `int a[4][5]`).	Apparently Accessible Out-of-Range Index
62	An attempt is made to access, or generate a pointer to just past, a flexible array member of a structure when the referenced object provides no elements for that array.	Pointer Past Flexible Array Member

Anchor
Forming Out-of-Bounds Pointer
Forming Out-of-Bounds Pointer
Noncompliant Code Example (Forming Out-of-Bounds Pointer)

...

In this compliant solution, the while loop in the GetMachineName() function is bounded so that the loop terminates when a backslash character is found, the null-termination character (L'\0') is discovered, or the end of the buffer is reached. Or, as coded, the while loop continues as long as each character is neither a backslash nor a null character and is not at the end of the buffer. This code does not result in a buffer overflow even if no backslash character is found in wszMachineName.

Code Block

bgColor	#ccccff
lang	c

HRESULT GetMachineName(
  wchar_t *pwszPath,
  wchar_t wszMachineName[MAX_COMPUTERNAME_LENGTH_FQDN+1])
{
  wchar_t *pwszServerName = wszMachineName;
  wchar_t *pwszTemp = pwszPath + 2;
  wchar_t *end_addr
    = pwszServerName + MAX_COMPUTERNAME_LENGTH_FQDN;
  while ( (*pwszTemp != L'\\') &&
      &&   ((*pwszTemp != L'\0')) &&
     &&    (pwszServerName < end_addr) )
  {
    *pwszServerName++ = *pwszTemp++;
  }

  /* ... */
}

...

Code Block

bgColor	#ffcccc
lang	c

#include <stdlib.h>
 
struct S {
  size_t len;
  char buf[];  /* Flexible array member */
};

const char *find(const struct S *s, int c) {
  const char *first = s->buf;
  const char *last  = s->buf + s->len;

  while (first++ != last) { /* Undefined behavior */
    if (*first == (unsigned char)c) {
      return first;
    }
  }
  return NULL;
}
 
void g(void) {
  struct S *s = (struct S *)malloc(sizeof(struct S));
  if (s == NULL) {
    /* Handle error */
  }
  s->len = 0;
  find(s, 'a');
}

...

Code Block

bgColor	#ccccff
lang	c

#include <stdlib.h>
 
struct S {
  size_t len;
  char buf[];  /* Flexible array member */
};

const char *find(const struct S *s, int c) {
  const char *first = s->buf;
  const char *last  = s->buf + s->len;

  while (first != last) { /* Avoid incrementing here */
    if (*++first == (unsigned char)c) {
      return first;
    }
  }
  return NULL;
}
 
void g(void) {
  struct S *s = (struct S *)malloc(sizeof(struct S));
  if (s == NULL) {
    /* Handle error */
  }
  s->len = 0;
  find(s, 'a');
}

...

Writing to out-of-range pointers or array subscripts can result in a buffer overflow and the execution of arbitrary code with the permissions of the vulnerable process. Reading from out-of-range pointers or array subscripts can result in unintended information disclosure.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
ARR30-C	High	Likely	High	P9	L2

Automated Detection

Tool

Version

Checker

Description

Astrée

Include Page

	Astrée_V
	Astrée_V

pointered

array-index-

deallocation Include Page

range
array-index-range-constant
null-dereferencing
pointered-deallocation
return-reference-local

Partially checked

CodeSonar

Can detect all accesses to invalid pointers as well as array index out-of-bounds accesses and prove their absence.

This rule is only partially checked as invalid but unused pointers may not be reported.

Axivion Bauhaus Suite

Include Page

	Axivion Bauhaus Suite_V
	Axivion Bauhaus Suite_V

CertC-ARR30

Can detect out-of-bound access to array / buffer

CodeSonar

Include Page

CodeSonar_V
	CodeSonar_V

LANG.MEM.BO
LANG.MEM.BU
LANG.MEM.TBA
LANG.MEM.TO
LANG.MEM.TU
LANG.STRUCT.PARITH
LANG.STRUCT.PBB
LANG.STRUCT.PPE
BADFUNC.BO.*

Buffer overrun
Buffer underrun
Tainted buffer access
Type overrun
Type underrun
Pointer Arithmetic
Pointer before beginning of object
Pointer past end of object
A collection of warning classes that report uses of library functions prone to internal buffer overflows.

Compass/ROSE

Could be configured to catch violations of this rule. The way to catch the noncompliant code example is to first hunt for example code that follows this pattern:

   for (LPWSTR pwszTemp = pwszPath + 2; *pwszTemp != L'\\';
   *pwszTemp++;)

In particular, the iteration variable is a pointer, it gets incremented, and the loop condition does not set an upper bound on the pointer. Once this case is handled, ROSE can handle cases like the real noncompliant code example, which is effectively the same semantics, just different syntax

Coverity

Include Page

	Coverity_V
	Coverity_V

OVERRUN

NEGATIVE_RETURNS

ARRAY_VS_SINGLETON

BUFFER_SIZE

Can detect the access of memory past the end of a memory buffer/array

Can detect when the loop bound may become negative

Can detect the out-of-bound read/write to array allocated statically or dynamically

Can detect buffer overflows

Klocwork

Cppcheck

Include Page

Klocwork

	Cppcheck_V

Klocwork

	Cppcheck_V

ABV.ANY_SIZE_ARRAY
ABV.GENERAL
ABV.STACK
ABV.TAINTED
ABV.UNICODE.BOUND_MAP
ABV.UNICODE.FAILED_MAP

arrayIndexOutOfBounds, outOfBounds, negativeIndex, arrayIndexThenCheck, arrayIndexOutOfBoundsCond, possibleBufferAccessOutOfBounds

Context sensitive analysis of array index, pointers, etc.

Array index out of bounds

Buffer overflow when calling various functions memset,strcpy,..

Warns about condition (a[i] == 0 && i < unknown_value) and recommends that (i < unknown_value && a[i] == 0) is used instead

Detects unsafe code when array is accessed before/after it is tested if the array index is out of bounds

Cppcheck Premium

Include Page

	Cppcheck Premium_V
	Cppcheck Premium_V

arrayIndexOutOfBounds, outOfBounds, negativeIndex, arrayIndexThenCheck, arrayIndexOutOfBoundsCond, possibleBufferAccessOutOfBounds

premium-cert-arr30-c

Context sensitive analysis of array index, pointers, etc.

Array index out of bounds

Buffer overflow when calling various functions memset,strcpy,..

Warns about condition (a[i] == 0 && i < unknown_value) and recommends that (i < unknown_value && a[i] == 0) is used instead

Detects unsafe code when array is accessed before/after it is tested if the array index is out of bounds

Helix QAC

Include Page

	Helix QAC_V
	Helix QAC_V

C2840

DF2820, DF2821, DF2822, DF2823, DF2840, DF2841, DF2842, DF2843, DF2930, DF2931, DF2932, DF2933, DF2935, DF2936, DF2937, DF2938, DF2950, DF2951, DF2952, DF2953

Klocwork

Include Page

	Klocwork_V
	Klocwork_V

ABV.GENERAL
ABV.GENERAL.MULTIDIMENSION
NPD.FUNC.CALL.MIGHT
ABV.ANY_SIZE_ARRAY
ABV.STACK
ABV.TAINTED
ABV.UNICODE.BOUND_MAP
ABV.UNICODE.FAILED_MAP
ABV.UNICODE.

ABV.UNICODE.

NNTS_MAP
ABV.UNICODE.SELF_MAP
ABV.UNKNOWN_SIZE
NNTS.MIGHT
NNTS.MUST
NNTS

.TAINTED
SV.STRBO.BOUND_COPY.OVERFLOW
SV.STRBO.BOUND_COPY.UNTERM
SV.STRBO.BOUND_SPRINTF
SV

.TAINTED

.ALLOC_SIZE

SV.TAINTED.

CALL.

INDEX

_ACCESS
SV.TAINTED.CALL.LOOP_BOUND
SV.TAINTED.INDEX_ACCESS
SV.TAINTED.LOOP_BOUND
SV.UNBOUND_STRING_INPUT.CIN

_ACCESS
SV.

UNBOUND_STRING_INPUT.FUNC

TAINTED.LOOP_BOUND

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

45 D, 47 S, 476 S, 489 S, 64 X, 66 X, 68 X, 69 X, 70 X, 71 X, 79 X

Partially implemented

Parasoft C/C++test

Include Page

c:

	Parasoft_V

c:Parasoft_VBD-PB-ARRAYPartially implementedPolyspace Bug FinderR2016a

Array access out of bounds, Array access with tainted index, Pointer access out of bounds, Pointer dereference with tainted offset, Use of tainted pointer

Array index outside bounds during array access

Array index from unsecure source possibly outside array bounds

Pointer dereferenced outside its bounds

Offset is from an unsecure source and dereference may be out of bounds

Pointer from an unsecure source may be NULL or point to unknown memory

PRQA QA-C Include PagePRQA QA-C_vPRQA QA-C_v

2840, 2841, 2842, 2843, 2844, 2930, 2931, 2932, 2933, 2934, 2950,
2951, 2952, 2953

Partially implementedPRQA QA-C++ Include Pagecplusplus:PRQA QA-C++_Vcplusplus:PRQA QA-C++_V

2820, 2821, 2822, 2823, 2824, 2840, 2841, 2842, 2843, 2844, 2930,
2931, 2932, 2950, 2951, 2952

Partially implementedCppcheck Include PageCppcheck_VCppcheck_VarrayIndexOutOfBounds, outOfBounds, negativeIndex, arrayIndexThenCheck, arrayIndexOutOfBoundsCond, possibleBufferAccessOutOfBounds

Context sensitive analysis of array index, pointers, etc.

Array index out of bounds

Buffer overflow when calling various functions memset,strcpy,..

Warns about condition (a[i] == 0 && i < unknown_value) and recommends that (i < unknown_value && a[i] == 0) is used instead

Detects unsafe code when array is accessed before/after it is tested if the array index is out of bounds


	Parasoft_V

CERT_C-ARR30-a

Avoid accessing arrays out of bounds

Parasoft Insure++

Runtime analysis

PC-lint Plus

Include Page

	PC-lint Plus_V
	PC-lint Plus_V

413, 415, 416, 613, 661, 662, 676

Fully supported

Polyspace Bug Finder

Include Page

	Polyspace Bug Finder_V
	Polyspace Bug Finder_V

CERT C: Rule ARR30-C

Checks for:

Array access out of bounds
Pointer access out of bounds
Array access with tainted index
Use of tainted pointer
Pointer dereference with tainted offset

Rule partially covered.

PVS-Studio

Include Page

	PVS-Studio_V
	PVS-Studio_V

V512, V557, V582, V594, V643, V645, V694, V1086

RuleChecker

Include Page

	RuleChecker_V
	RuleChecker_V

array-index-range-constant
return-reference-local

Partially checked

TrustInSoft Analyzer

Include Page

	TrustInSoft Analyzer_V
	TrustInSoft Analyzer_V

index_in_address

Exhaustively verified (see one compliant and one non-compliant example).

Related Vulnerabilities

CVE-2008-1517 results from a violation of this rule. Before Mac OSX version 10.5.7, the XNU kernel accessed an array at an unverified user-input index, allowing an attacker to execute arbitrary code by passing an index greater than the length of the array and therefore accessing outside memory [xorl 2009].

...

Key here (explains table format and definitions)

Taxonomy	Taxonomy item	Relationship
ISO/IEC TR 24772:2013	Arithmetic Wrap-Around Error [FIF]	Prior to 2018-01-12: CERT: Unspecified Relationship
ISO/IEC TR 24772:2013	Unchecked Array Indexing [XYZ]	Prior to 2018-01-12: CERT: Unspecified Relationship
ISO/IEC TS 17961	Forming or using out-of-bounds pointers or array subscripts [invptr]	Prior to 2018-01-12: CERT: Unspecified Relationship
CWE 2.11	CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer	2017-05-18: CERT: Rule subset of CWE
CWE 2.11	CWE-123, Write-what-where Condition	2017-05-18: CERT: Partial overlap
CWE 2.11	CWE-125, Out-of-bounds Read	2017-05-18: CERT: Partial overlap
MISRA C:2012	Rule 18.1 (required)	Prior to 2018-01-12: CERT: Unspecified Relationship

CERT-CWE Mapping Notes

Key here for mapping notes

...

Independent( ARR30-C, ARR38-C, ARR32-C, INT30-C, INT31-C, EXP39-C, EXP33-C, FIO37-C)

STR31-C = Subset( Union( ARR30-C, ARR38-C))

STR32-C = Subset( ARR38-C)

CWE-119 = Union( ARR30-C, ARR38-C)

Intersection( ARR30-C, ARR38-C) = Ø

...

Independent( ARR30-C, ARR38-C, EXP39-C, INT30-C)

STR31-C = Subset( Union( ARR30-C, ARR38-C))

STR32-C = Subset( ARR38-C)

CWE-125 = Subset( CWE-119) = Union( ARR30-C, ARR38-C)

Intersection( ARR30-C, CWE-125) =

...

Independent(ARR30-C, ARR38-C)

STR31-C = Subset( Union( ARR30-C, ARR38-C))

STR32-C = Subset( ARR38-C)

...

CWE-789 is about allocating memory, not array subscripting

Bibliography

[Finlay 2003]

[Microsoft 2003]


[Pethia 2003]


[Seacord 2013b]	Chapter 1, "Running with Scissors"
[Viega 2005]	Section 5.2.13, "Unchecked Array Indexing"
[xorl 2009 ]	"CVE-2008-1517: Apple Mac OS X (XNU) Missing Array Index Validation"

...

Space shortcuts

Page tree

Versions Compared

Old Version 124

New Version Current

Key

Anchor
Forming Out-of-Bounds Pointer
Forming Out-of-Bounds Pointer
Noncompliant Code Example (Forming Out-of-Bounds Pointer)

Automated Detection

Related Vulnerabilities

CERT-CWE Mapping Notes

Bibliography

Space shortcuts

Page tree

Page History

Versions Compared

Old Version 124

New Version Current

Key

AnchorForming Out-of-Bounds PointerForming Out-of-Bounds PointerNoncompliant Code Example (Forming Out-of-Bounds Pointer)

Automated Detection

Related Vulnerabilities

CERT-CWE Mapping Notes

Bibliography

Anchor
Forming Out-of-Bounds Pointer
Forming Out-of-Bounds Pointer
Noncompliant Code Example (Forming Out-of-Bounds Pointer)