Page History

The three types char, signed char, and unsigned char are collectively called the character types. Compilers have the latitude to define char to have the same range, representation, and behavior as either signed char or unsigned char. Irrespective of the choice made, char is a separate type from the other two and is not compatible with either.

Use only signed char and unsigned char types for the storage and use of numeric values , as this is because it is the only portable way to guarantee the signedness of the character types . See (see STR00-A. Understand how to best represent strings) more more C. Represent characters using an appropriate type for more information on representing characters).

...

Noncompliant Code Example

In this non-compliant noncompliant code example, the char-type variable c may be signed or unsigned. Assuming 8-bit, two's complement character types, this code may either print out either i/c = 5 (unsigned) or i/c = -17 (signed). As a result, it It is much more difficult to reason about the correctness of a program without knowing if these integers are signed or unsigned.

char c = 200;
int i = 1000;
printf("i/c = %d\n", i/c);

Compliant Solution

In this compliant solution, the variable c is declared as unsigned char. The subsequent division operation is now independent of the signedness of char and consequently has a predictable result.

unsigned char c = 200;
int i = 1000;
printf("i/c = %d\n", i/c);

Exceptions

INT07-C-EX1: void FIO34-C. Use int to capture the return value of character IO functions that might be used to check for end of file mentions that certain character IO functions return a value of type int. Despite being returned in an arithmetic type, the value is not actually numeric in nature, so it is acceptable to later store the result into a variable of type char.

Risk Assessment

This is a subtle error that results in a disturbingly broad range of potentially severe vulnerabilities. At the very least, this error can lead to unexpected numerical results on different platforms. Unexpected arithmetic values when applied to arrays or pointers can yield buffer overflows or other invalid memory access.

Automated Detection

...

The LDRA tool suite V 7.6.0 is able to detect violations of this recommendation.

...

Tool	Version	Checker	Description
Astrée	Include Page Astrée_V Astrée_V		Supported indirectly via MISRA C:2012 rules 10.1, 10.3 and 10.4.
Axivion Bauhaus Suite	Include Page Axivion Bauhaus Suite_V Axivion Bauhaus Suite_V	CertC-INT07
CodeSonar	Include Page CodeSonar_V CodeSonar_V	LANG.TYPE.IOT	Inappropriate operand type
Compass/ROSE			Can detect violations of this recommendation. In particular, it flags any instance of a variable of type char (without a signed or unsigned qualifier) that appears in an arithmetic expression
ECLAIR	Include Page ECLAIR_V ECLAIR_V	CC2.INT07	Fully implemented
Helix QAC	Include Page Helix QAC_V Helix QAC_V	C1292, C1293, C4401, C4421, C4431, C4441, C4451
Klocwork	Include Page Klocwork_V Klocwork_V	PORTING.SIGNED.CHAR
LDRA tool suite	Include Page LDRA_V LDRA_V	93 S, 96 S, 101 S, 329 S, 432 S, 458 S	Fully implemented
Parasoft C/C++test	Include Page Parasoft_V Parasoft_V	CERT_C-INT07-a CERT_C-INT07-b	The plain char type shall be used only for the storage and use of character values signed and unsigned char type shall be used only for the storage and use of numeric values
PC-lint Plus	Include Page PC-lint Plus_V PC-lint Plus_V	9112	Fully supported
Polyspace Bug Finder	Include Page Polyspace Bug Finder_V Polyspace Bug Finder_V	CERT C: Rec. INT07-C	Checks for use of plain char type for numeric value (rec. fully covered)
Splint	Include Page Splint_V Splint_V
RuleChecker	Include Page RuleChecker_V RuleChecker_V		Supported indirectly via MISRA C:2012 rules 10.1, 10.3 and 10.4.
SonarQube C/C++ Plugin	Include Page SonarQube C/C++ Plugin_V SonarQube C/C++ Plugin_V	S820

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.2.5, "Types"
\[[MISRA 04|AA. C References#MISRA 04]\] Rule 6.2, "Signed and unsigned char type shall be used only for the storage and use of numeric values"

Related Guidelines

...

Image Added Image Added Image AddedINT06-A. Use strtol() or a related function to convert a string token to an integer      04. Integers (INT)       INT08-A. Verify that all integer values are in range