Page History

...

Use only signed char and unsigned char types for the storage and use of numeric values because it is the only portable way to guarantee the signedness of the character types . See (see STR00-C. Represent characters using an appropriate type for more information on representing characters).

Noncompliant Code Example

In this noncompliant code example, the char-type variable c may be signed or unsigned. Assuming 8-bit, two's complement character types, this code may either print out either i/c = 5 (unsigned) or i/c = -17 (signed). It is much more difficult to reason about the correctness of a program without knowing if these integers are signed or unsigned.

...

unsigned char c = 200;
int i = 1000;
printf("i/c = %d\n", i/c);

Exceptions

INT07-C-EX1: void FIO34-C. Use int to capture the return value of character IO functions that might be used to check for end of file mentions that certain character IO functions return a value of type int. Despite being returned in an arithmetic type, the value is not actually numeric in nature, so it is acceptable to later store the result into a variable of type char.

...

This is a subtle error that results in a disturbingly broad range of potentially severe vulnerabilities. At the very least, this error can lead to unexpected numerical results on different platforms. Unexpected arithmetic values when applied to arrays or pointers can yield buffer overflows or other invalid memory access.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

...

Image Modified Image Modified Image Modified