Page History

Assertions are a valuable diagnostic tool for finding and eliminating software defects that may result in vulnerabilities (see MSC11-C. Incorporate diagnostic tests using assertions). The runtime assert() macro has some limitations, however, in that it incurs a runtime overhead and because it calls abort(). Consequently, the runtime assert() macro is useful only for identifying incorrect assumptions and not for runtime error checking. As a result, runtime assertions are generally unsuitable for server programs or embedded systems.

Static assertion is a new facility in the C Standard. It takes the form

This standard recommends the inclusion of diagnostic tests into your program using the {{assert()}} macro or other mechanisms (see \[[MSC11-A. Incorporate diagnostic tests using assertions]]). Static assertion is a new facility in the C++ )X draft standard.  This facility gives the ability to make assertions at compile time rather than runtime, providing the following advantages:

• all processing must be performed during compile time – no runtime cost in space or time is tolerable
• assertion failure must result in a meaningful and informative diagnostic error message
• it can be used at file or block scope
• misuse does not result in silent malfunction, but rather is diagnosed at compile time

Static assertions take the form:

static_assert(constant-expression, string-literal);

...

Subclause 6.7.10 of the C Standard [ISO/IEC 9899:2011] states:

The constant expression shall be an integer constant expression. If the value of

...

the constant expression compares unequal to 0, the declaration has no effect. Otherwise

...

, the constraint is violated and the implementation shall produce a diagnostic message

...

that includes the text of the string literal, except that characters not in the basic source character set are not required to appear in the message.

It means that if constant-expression is true, nothing will happen. However, if constant-expression is false, an error message containing string-literal will be output -literal is issued at compile time.While not yet available in C, this behavior can be mimicked as follows:

#define JOIN(x, y) JOIN_AGAIN(x, y)
#define JOIN_AGAIN(x, y) x ## y

#define compile_time_assert(e) \
  typedef char JOIN(assert_, __LINE__) [(e) ? 1 : -1]

int main(void) {
  static_assert(/* Passes */
static_assert(
  sizeof(int) <= sizeof(longvoid*), 
  "sizeof(int) <= sizeof(longvoid*)"
); 

/* PassesFails */
  static_assert(
  sizeof(double) <= sizeof(int), 
  "sizeof(double) <= sizeof(int)"
); /* Fails */
} 

The  {{JOIN()}} macro used the {{##}} operator \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] to concatenate tokens. See \[[PRE05-A. Use ## sparingly and with caution]] to understand how macro replacement behaves in C when using the {{##}} operator.

The macro argument string-literal is ignored in this case, this is meant for future compatibility.

Non-Compliant Code Example

Static assertion is not available in C99.

Noncompliant Code Example

This noncompliant This non-compliant code uses the assert() macro to assert a property concerning a memory-mapped structure that is essential for the code that uses this structure to behave correctly.:

#include <assert.h>
 
struct timer {
  unsigned uint8_tchar MODE;
  unsigned uint32_tint DATA;
  unsigned uint32_tint COUNT;
};
 
int mainfunc(void) {
  assert(offsetofsizeof(struct timer, DATA) == 4sizeof(unsigned char) + sizeof(unsigned int) + sizeof(unsigned int));
}

While the Although the use of the runtime assertion is better than nothing, it needs to be placed in a function and executed, typically removed from . This means that it is usually far away from the definition of the actual structure to which it refers. The diagnostic occurs only occurs at runtime , and only if the code path containing the assertion is executed.

...

Compliant

...

Solution

For assertions involving only constant expressions, some C++ compilers let you use a preprocessor conditional statement may be used, as in this compliant solution:

struct timer {
  unsigned char MODE;
  unsigned int DATA;
  unsigned int COUNT;
};


#if (offsetofsizeof(struct timer, DATA) != 4 (sizeof(unsigned char) + sizeof(unsigned int) + sizeof(unsigned int)))
  #error DATA"Structure must benot athave offsetany 4padding"
#endif

C99 does not recognize sizeof, offsetof and enumeration constants in #if conditions. Some compilers allow these constructs in conditionals as an extension, but most do notUsing #error directives allows for clear diagnostic messages. Because this approach evaluates assertions at compile time, there is no runtime penalty.

Compliant Solution

This portable compliant solution ... uses static_assert:

#include <assert.h>
 
struct timer {
  unsigned char MODE;
  unsigned int DATA;
  unsigned int COUNT;
};

static_assert(sizeof(longstruct timer) >= 8, "64-bit code generation required for this library.");

Risk Assessment

== sizeof(unsigned char) + sizeof(unsigned int) + sizeof(unsigned int),
              "Structure must not have any padding");

Static assertions allow incorrect assumptions to be diagnosed at compile time instead of resulting in a silent malfunction or runtime error. Because the assertion is performed at compile time, no runtime cost in space or time is incurred. An assertion can be used at file or block scope, and failure results in a meaningful and informative diagnostic error message.

Other uses of static assertion are shown in STR07-C. Use the bounds-checking interfaces for string manipulation and FIO34-C. Distinguish between characters read from a file and EOF or WEOF.

Risk Assessment

Static assertion is a valuable diagnostic tool for finding and eliminating software defects that may result in vulnerabilities at compile time. The absence of static assertions, however, does not mean that code is incorrect.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

...

Related Guidelines

 Bibliography

...

Image Added Image Added Image Added 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.10.3.3, "The ## operator" [Klarer 04] R. Klarer, J. Maddock, B. Dawes, and H. Hinnant. "Proposal to Add Static Assertions to the Core Language (Revision 3)" (ISO C++ committee paper ISO/IEC JTC1/SC22/WG21/N1720, October 2004). This document is available online at http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2004/n1720.html. \[Saks 08] Dan Saks, Stephen C. Dewhurst. Presentation. Sooner Rather Than Later: Static Programming Techniques for C++. \[Saks 05] Dan Saks. [_Catching errors early with compile-time assertions|http://www.embedded.com/columns/programmingpointers/164900888?_requestid=287187]. Embedded Systems Design. June, 2005. \[Eckel 2007] Bruce Eckel. [_Thinking in C++ - Volume 2_|http://bruce-eckel.developpez.com/livres/cpp/ticpp/v2/]. January 25, 2007.DCL02-A. Use visually distinct identifiers       02. Declarations and Initialization (DCL)       DCL04-A. Take care when declaring more than one variable per declaration