...
Do not use std::memset() to initialize an object of nontrivial class type as it may not properly initialize the value representation of the object. Do not use std::memcpy() (or related bytewise copy functions) to initialize a copy of an object of nontrivial class type, as it may not properly initialize the value representation of the copy. Do not use std::memcmp() (or related bytewise comparison functions) to compare objects of nonstandard-layout class type, as it may not properly compare the value representations of the objects. In all cases, it is best to prefer the alternatives.
| C Standard Library Function | C++ Equivalent Functionality |
|---|---|
std::memset() | Class constructor |
std::memcpy()std::memmove()std::strcpy() | Class copy constructor or operator=() |
std::memcmp()std::strcmp() | operator<(), operator>(), operator==(), or operator!=() |
Noncompliant Code Example
...
Most violations of this rule will result in abnormal program behavior. However, overwriting implementation details of the object representation can lead to code execution vulnerabilities.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
OOP57-CPP | High | Probable | High | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| stdlib-use-ato stdlib-use stdlib-use-getenv stdlib-use-system include-time stdlib-use-string-unbounded | Partially checked | ||||||
| CodeSonar |
| BADFUNC.MEMCMP BADFUNC.MEMSET | Use of memcmp Use of memset | ||||||
| Helix QAC |
| C++5017, C++5038 | |||||||
| Klocwork |
| CERT.OOP.CSTD_FUNC_USE | |||||||
| LDRA tool suite |
| 44 S | Enhanced Enforcement | ||||||
| Parasoft C/C++test |
| CERT_CPP-OOP57-a | Do not initialize objects with a non-trivial class type using C standard library functions | ||||||
| Polyspace Bug Finder |
| CERT C++: OOP57-CPP | Checks for bytewise operations on nontrivial class object (rule fully covered) | ||||||
| PVS-Studio |
| V598, V780 | |||||||
| RuleChecker |
| stdlib-use-ato stdlib-use stdlib-use-getenv stdlib-use-system include-time stdlib-use-string-unbounded | Partially checked |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Bibliography
| [ISO/IEC 14882-2014] | Subclause 3.9, "Types" Subclause 3.10, "Lvalues and Rvalues" Clause 9, "Classes" |
...