EXP06-C. Operands to the sizeof operator should not contain side effects

The sizeof operator yields the size (in bytes) of its operand, which may be an expression or the parenthesized name of a type. When the type of the operand is a variable length array type (VLA) the expression is evaluated; otherwise, the operand is not evaluated.

When part of the operand of the sizeof operator is a VLA type and when changing the value of the VLA's size expression would not affect the result of the operator, it is unspecified whether or not the size expression is evaluated. See unspecified behavior 22 in Annex J, subclause J.1, of the C Standard [ISO/IEC 9899:2011].

Providing an expression that appears to produce side effects may be misleading to programmers who are not aware that these expressions are not evaluated in the non-VLA case and have unspecified results otherwise. As a result, programmers may make invalid assumptions about program state, leading to errors and possible software vulnerabilities.

Noncompliant Code Example

In this noncompliant code example, the expression a++ is not evaluated, and the side effects in the expression are not executed:

int a = 14;
int b = sizeof(a++);

Consequently, the value of a after b has been initialized is 14.

Implementation-Specific Details

This example compiles cleanly under Microsoft Visual Studio 2005, version 8.0, with the /W4 option.

Compliant Solution

In this compliant solution, the variable a is incremented:

int a = 14;
int b = sizeof(a);
a++;

Noncompliant Code Example (Variable Length Array)

In the following noncompliant code example, the expression ++n in the initialization expression of a must be evaluated because its value affects the size of the VLA operand of the sizeof operator. However, because the expression ++n % 1 evaluates to 0, regardless of the value of n, its value does not affect the result of the sizeof operator. Consequently, it is unspecified whether or not n is incremented.

void f(size_t n) {
  size_t a = sizeof(int [++n]);           /* n must be incremented */
  size_t b = sizeof(int [++n % 1 + 1]);   /* n need not be incremented */
  /* ... */
}

Compliant Solution (Variable Length Array)

This compliant solution avoids changing the value of the variable n used in the sizeof expression and instead increments it safely outside of it:

void f(size_t n) {
  size_t a = sizeof(int [n + 1]);
  ++n;

  size_t b = sizeof(int [n % 1 + 1]);
  ++n;
  /* ... */
}

Risk Assessment

If expressions that appear to produce side effects are supplied to the sizeof operator, the returned result may be different than expected. Depending on how this result is used, it can lead to unintended program behavior.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines