...
Unlike passed-by-value arguments and pointers, pointed-to values are a concern. A function may modify a value referenced by a pointer argument, leading to a side effect that persists even after the function exits. Modification of the pointed-to value is not diagnosed by the compiler, which assumes this behavior was intended.
...
The const-qualification of the second argument, s2, eliminates the spurious warning in the initial invocation but maintains the valid warning on the final invocation in which a const-qualified object is passed as the first argument (which can change). Finally, the middle strcat() invocation is now valid because c_str3 is a valid destination string and may be safely modified.
Risk Assessment
Not declaring Failing to declare an unchanging value const prohibits the function from working with values already cast as const. This problem can be sidestepped by type casting away the const, but doing so violates EXP05-C. Do not cast away a const qualification.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
DCL13-C |
Low |
Unlikely |
Low | P3 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| parameter-missing-const | Fully checked | ||||||
| Axivion Bauhaus Suite |
| CertC-DCL13 | |||||||
| CodeSonar |
| LANG.TYPE.CBCONST | Pointed-to Type Could Be const | ||||||
| Compass/ROSE |
Can detect violations of this recommendation while checking for violations of recommendation DCL00-C. Const-qualify immutable objects | |||||||||
| CC2.DCL13 | Fully implemented | |||||||
| Helix QAC |
| C0431, C3673, C3677 | |||||||
| Klocwork |
| MISRA.PPARAM.NEEDS.CONST | |||||||
| LDRA tool suite |
|
120 D | Fully implemented |
3673
0431(C)
| Parasoft C/C++test |
| CERT_C-DCL13-a | A pointer parameter in a function prototype should be declared as pointer to const if the pointer is not used to modify the addressed object | ||||||
| PC-lint Plus |
| 111, 818 | Fully supported | ||||||
| Polyspace Bug Finder |
| CERT C: Rec. DCL13-C | Checks for pointer to non-const qualified function parameter (rec. fully covered) | ||||||
| RuleChecker |
| parameter-missing-const | Fully checked |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| SEI CERT C++ |
| Coding Standard | VOID DCL13-CPP. Declare function parameters that are pointers to values not changed by the function as const |
| ISO/IEC TR 24772:2013 | Passing Parameters and Return Values [CSJ] |
Bibliography
| [ISO/IEC 9899:2011] | Annex I "Common Warnings" |
...
| MISRA C:2012 | Rule 8.13 (advisory) |
...