Page History

An object that has volatile-qualified type may be modified in ways unknown to the implementation or have other unknown side effects. It is possible to reference Referencing a volatile object by using a non-volatile value but the resulting behavior lvalue is undefined . According to C99 Section behavior. The C Standard, 6.7.3 Type qualifiers Paragraph 5:4 paragraph 7 [ISO/IEC 9899:2024], states

If an attempt is made to refer to an object defined with a volatile-qualified type through use of an lvalue with non-volatile-qualified type, the behavior is undefined.

This also applies to objects that behave as if they were defined with qualified types such as an object at a memory-mapped input/output address.

See undefined behavior 65.

Noncompliant

...

Code Example

In this noncompliant code example, a volatile object is accessed through a non-volatile-qualified reference, resulting in undefined behavior:

#include <stdio.h>
 
void func
int main(void) {
  static volatile int **ipp;
  static int *ip;
  static volatile int i = 0;;

  printf("i = %d.\n", i);

  ipp = &ip; /* May produce a warning diagnostic */ constraint violation
  ipp = (int**) &ip; /* Constraint violation; may produce a warning diagnostic */
  *ipp = &i; /* Valid */ valid
  if (*ip != 0) { /* Valid */
  valid
	// i had been changed/* ... */
  }
}

The first assignment is unsafe ipp = &ip is not safe because it would allow allows the following valid code that follows to reference the value of the volatile object i through a the non-volatile-qualified reference ip. In this example, the compiler may optimize out the entire if block because *ip != 0 must be false if the object to which ip points is not volatile.

Implementation

...

Details

This example compiles without warning on Microsoft Visual Studio 2013 when compiled in C mode (/TC) but causes errors when compiled in C++ .NET mode (2003) and on MS Visual Studio 2005. Version 3.2.2 of the gcc compiler /TP).

GCC 4.8.1 generates a warning but compiles successfully.

Compliant Solution

In this compliant solution the int * , ip is declared as volatile.:

int main#include <stdio.h>

void func(void) {
  static volatile int **ipp;
  static volatile int *ip;
  static volatile int i = 0;;

  printf("i = %d.\n", i);

  ipp = &ip; // constraint violation
  *ipp = &i; // valid
  if (*ip != 0) { // valid
    /* i has changed ... */
  }

...

}

Risk Assessment

Accessing an object with a volatile object through -qualified type through a reference with a non-volatile reference results in undefined behavior.

References

...

-qualified type is undefined behavior.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

Bibliography

...

Image Added Image Added Image Added