Page History

...

The C Standard identifies four different kinds of nonportable behavior. Each section of Annex J of the C Standard enumerates distinct instances of behaviors of each kind.

An example of undefined behavior is passing a null char* pointer as an argument to the printf function corresponding to the %s format specification. Although some implementations (such as the GNU C Library) provide well-defined semantics for this case, others do not, causing programs that rely on this behavior to fail abnormally.

...

This noncompliant code example uses the complement operator in the test for unsigned integer overflow. It assumes both numbers are nonnegative:

unsignedsigned int uisi;
unsignedsigned int ui2si2;
unsignedsigned int sum;

if (~uisi < 0 || si2 < 0) {
  /* Handle error condition */
}
if (~si < ui2si2) {
  /* Handle error condition */
}
sum = uisi + ui2si2;

This code assumes that the implementation uses two's complement representation. This assumption is commonly true but is not guaranteed by the standard.

...

This compliant solution implements a strictly conforming test for unsigned overflow:

unsigned int uisi;
unsigned int ui2si2;
unsigned int sum;

if (si < 0 || si2 < 0) {
  /* Handle error condition */
}
if (UINTINT_MAX - uisi < ui2si2) {
  /* Handle error condition */
}
sum = uisi + ui2si2;

If the noncompliant form of this test is truly faster, talk to your compiler vendor because, if these tests are equivalent, optimization should occur. If both forms have the same performance, prefer the portable form.

...

The GNU libc implementation of strerror_r declares the function to return char*, in conflict with the POSIX specification. The following This noncompliant code example relies on this return type to pass the return value as an argument to the %s formatting directive to fprintf. The behavior of the example will be undefined on a platform that declares the return type of strerror_r() to be int, in accordance with POSIX.

...

The compliant solution disables the nonconforming declaration of strerror_r() by explicitly requesting POSIX conformance before including the <string.h> header that declares the function and handles the function's failure by copying the "Unknown error" string into the buffer. An alternate solution is to use the strerror_s() function defined by Annex K.

Note that the function assigns the result of the call to strerror_r() to a variable of type int. This assignment is a defense-in-depth strategy guarding against inadvertently invoking strerror_r() that returns char*: a conforming compiler is required to issue a diagnostic for the ill-formed conversion from char* to int.

...

Unnecessary platform dependencies are, by definition, unnecessary. Avoiding these dependencies can eliminate porting errors resulting from invalidated assumptions.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...

Image Modified Image Modified Image Modified