MEM33-C. Allocate and copy structures containing flexible array members dynamically

The C Standard provides flexible array members in the C language. While flexible array members are useful, they need to be understood and used with care.

The following is an example of a structure that contains a flexible array member:

struct flexArrayStruct {
  int num;
  int data[];
};

This definition means that when allocating storage, only the first member, num, is considered. Consequently, the result of accessing the member data of a variable of type struct flexArrayStruct is undefined. DCL38-C. Use the correct syntax when declaring flexible array members describes the correct way to declare a struct with a flexible array member.

To avoid the potential for undefined behavior, structures that contain a flexible array member should always be allocated and operated on dynamically. Flexible array structures should not be:

• declared on the stack; they should be on the heap.
• copied via assignment; they should be copied using memcpy() or a similar function.
• passed as raw arguments to functions; should be passed as a pointer instead.

Noncompliant Code Example (Storage Allocation)

This noncompliant code example statically allocates storage for a structure containing a flexible array member:

struct flexArrayStruct {
  int num;
  int data[];
};
 
void func(void) {
  struct flexArrayStruct flexStruct;
  size_t array_size = 4;

  /* Initialize structure */
  flexStruct.num = array_size;

  for (size_t i = 0; i < array_size; i++) {
    flexStruct.data[i] = 0;
  }
}

The problem with this code is that the flexArrayStruct does not actually reserve space for the integer array data; it can't because the size is not specified. Consequently, although initializing the num member to zero is allowed, attempting to write even one value into data (that is, data[0]) is likely to overwrite memory outside of the object's bounds.

Compliant Solution (Storage Allocation)

This compliant solution dynamically allocates storage for struct flexArrayStruct:

#include <stdlib.h>
 
struct flexArrayStruct {
  int num;
  int data[];
};
 
void func(void) {
  struct flexArrayStruct *flexStruct;
  size_t array_size = 4;

  /* Dynamically allocate memory for the structure. */
  flexStruct = (struct flexArrayStruct *)malloc(
    sizeof(struct flexArrayStruct) + sizeof(int) * array_size);
  if (flexStruct == NULL) {
    /* Handle error */
  }

  /* Initialize structure */
  flexStruct->num = array_size;

  for (size_t i = 0; i < array_size; i++) {
    flexStruct->data[i] = 0;
  }
}

The data[] member of flexStruct can now be accessed as described in the C Standard, subclause 6.7.2.1, paragraph 18 [ISO/IEC 9899:2011].

Noncompliant Code Example (Copying)

This noncompliant code example attempts to copy an instance of a structure containing a flexible array member (struct flexArrayStruct) by assignment:

struct flexArrayStruct {
  int num;
  int data[];
};
 
void func(struct flexArrayStruct *structA,
          struct flexArrayStruct *structB) {
  *flexStructB = *flexStructA;
}

The problem with this noncompliant code example is that when the structure is copied, the size of the flexible array member is not considered, and only the first member of the structure, num, is copied.

Compliant Solution (Copying)

This compliant solution uses memcpy() to properly copy the content of structA into structB:

#include <string.h>
 
struct flexArrayStruct {
  int num;
  int data[];
};
 
void func(struct flexArrayStruct *structA,
          struct flexArrayStruct *structB) {
  memcpy(structB, structA,
         sizeof(struct flexArrayStruct) + (sizeof(int)
           * array_size));
}

This compliant solution ensures that the entire structure, including the flexible array member, is copied correctly.

Noncompliant Code Example (Function Arguments)

In this noncompliant code example, the flexible array structure is passed directly to a function that tries to print the array elements:

#include <stdio.h>
#include <stdlib.h>
 
struct flexArrayStruct {
  int num;
  int data[];
};
 
void print_array(struct flexArrayStruct structP) {
  puts("Array is: ");
  for (size_t i = 0; i < structP.num; i++) {
    printf("%d", structP.data[i]);
  }
  puts("\n");
}

void func(void) {
  struct flexArrayStruct *structP;
  size_t array_size = 4;

  /* Space is allocated for the struct. */
  structP = (struct flexArrayStruct *)malloc(
    sizeof(struct flexArrayStruct) + sizeof(int) * array_size);
  if (structP == NULL) {
    /* Handle error */
  }
  structP->num = array_size;

  for (size_t i = 0; i < array_size; i++) {
    structP->data[i] = i;
  }
  print_array(*structP);
}

Because C passes the argument by value, the structure is copied onto the stack. The size of the flexible array member is not considered when the structure is copied, and only the first member of the structure, num, is copied.

Compliant Solution (Function Arguments)

In this compliant solution, the print_array() function accepts a pointer to the structure rather than the structure itself:

#include <stdio.h>
#include <stdlib.h>
 
struct flexArrayStruct {
  int num;
  int data[];
};
 
void print_array(struct flexArrayStruct *structP) {
  puts("Array is: ");
  for (size_t i = 0; i < structP->num; i++) {
    printf("%d", structP->data[i]);
  }
  puts("\n");
}
 
void func(void) {
  struct flexArrayStruct *structP;
  size_t array_size = 4;

  /* Space is allocated for the struct. */
  structP = (struct flexArrayStruct *)malloc(
    sizeof(struct flexArrayStruct) + sizeof(int) * array_size);
  if (structP == NULL) {
    /* Handle error */
  }
  structP->num = array_size;

  for (size_t i = 0; i < array_size; i++) {
    structP->data[i] = i;
  }
  print_array(structP);
}

Risk Assessment

Failure to use structures with flexible array members correctly can result in undefined behavior. 

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography