Page History

...

Similarly, the std::string::back() and std::string::front() functions are unchecked as they are defined to call through to the appropriate operator[]() overload without  without throwing.

Do not pass an out-of-range value as an argument to std::string::opperatoroperator[](). Similarly, do not call std::string::back() or std::string::front() on an empty string. This rule is a specific instance of CTR50-CPP. Guarantee that container indices and iterators are within the valid range.

...

In this noncompliant code example, the value returned by the call to get_index() may be greater than the number of elements stored in the string, resulting in undefined behavior:.

#include <string>
 
extern std::size_t get_index();
 
void f() {
  std::string s("01234567");
  s[get_index()] = '1';

}

Compliant Solution (try/catch)

This compliant solution uses the std::basic_string::at() function, which behaves in a similar fashion to the index operator[] but throws a std::out_of_range exception if pos >= size():.

#include <stdexcept>
#include <string>

extern std::size_t get_index();

void f() {
  std::string s("01234567");
  try {
    s.at(get_index()) = '1';
  } catch (std::out_of_range &) {
    // Handle error
  }
}

...

This compliant solution checks that the value returned by get_index() is within a valid range before calling operator[]():.

#include <string>

extern std::size_t get_index();

void f() {
  std::string s("01234567");
  std::size_t i = get_index();
  if (i < s.length()) {
    s[i] = '1';
  } else {
    // Handle error
  }
}

...

#include <string>
#include <locale>

void capitalize(std::string &Ss) {
  std::locale Lloc;
  Ss.front() = std::use_facet<std::ctype<char>>(Lloc).toupper(Ss.front());
}

Compliant Solution

In this compliant solution, the call to std::string::front() is made only if the string is not empty:.

#include <string>
#include <locale>

void capitalize(std::string &Ss) {
  if (Ss.empty()) {
    return;
  }

  std::locale Lloc;
  Ss.front() = std::use_facet<std::ctype<char>>(Lloc).toupper(Ss.front());
}

Risk Assessment

Unchecked element access can lead to out-of-bounds bound reads and writes and write-anywhere exploits. These exploits can, in turn, lead to the execution of arbitrary code with the permissions of the vulnerable process.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...

...

Image Modified Image Modified Image Modified