Avoid in-band error indicators while designing interfaces. This practice is commonly used by C library functions but is not recommended. One example from the C Standard of a troublesome in-band error indicator is EOF. (See see FIO34-C. Use int to capture the return value of character IO functions and FIO35-C. Use feof() and ferror() to detect end-of-file and file errors when sizeof(int) == sizeof(char).) Distinguish between characters read from a file and EOF or WEOF). Another problematic use of in-band error indicators from the C Standard involving the size_t and time_t types is described by MSC31by
...
- integer conversions do not result in lost or misinterpreted data
- FLP07-C. Cast the return value of a function that returns a floating-point type
- INT18-C. Evaluate integer expressions in a larger size before comparing or assigning to that size
...
Noncompliant Code Example (sprintf())
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
constraint_handler_t handle_errors(void) {
constraint_handler_t data;
/* Define what to do when error occurs */
return data;
}
/* ... */
set_constraint_handler(handle_errors);
/* ... */
/* Returns zero on success */
errno_t function(char *dst1, size_t dst_size) {
char src1[100] = "hello";
strcpy_s(dst1, sizeof(dst1)dst_size, src1);
/*
* At this point strcpy_s may have yielded an
* error, and handle_errors() might have returned.
*/
/* ... */
return 0;
}
|
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
/* * The abort_handler_s() function writes * a message on the standard error stream and * then calls the abort() function. */ set_constraint_handler(abort_handler_s); /* ... */ /* Returns zero on success */ errno_t function(char *dst1, size_t dst_size) { char src1[100] = "hello"; strcpy_s(dst1, sizeof(dst1)dst_size, src1); /* * Because abort_handler_s() never returns, * we get here only if strcpy_s() succeeds. */ /* ... */ return 0; } |
...
The risk in using in-band error indicators is difficult to quantify and is consequently given as low. However, if the use of in-band error indicators results in programmers' failing to check status codes or incorrectly checking them, the consequences can be more severe.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
ERR02-C | Low | Unlikely | High | P1 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Parasoft C/C++test |
| CERT_C-ERR02-a | The input/output functions from the 'cstdio' and 'cwchar' libraries should not be used |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Bibliography
| [Burch 2006] |
| [ISO/IEC 9899:2011] |
Subclause 6.3.2, "Other Operands" |
...
...