An object that has volatile-qualified type may be modified in ways unknown to the implementation or have other unknown side effects. Referencing a volatile object by using a nonvolatile value non-volatile lvalue results in undefined behavior. The C Standard, subclause 6.7.3 [ISO/IEC 9899:2011], states:
...
In this noncompliant code example, a volatile object is accessed through a non-volatile-qualified reference, resulting in undefined behavior:
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stdio.h>
void func(void) {
static volatile int **ipp;
static int *ip;
static volatile int i = 0;
printf("i = %d.\n", i);
ipp = &ip; /* ProducesMay warningsproduce ina modernwarning compilersdiagnostic */
ipp = (int**) &ip; /* Constraint violation; also produces warningsmay produce a warning diagnostic */
*ipp = &i; /* Valid */
if (*ip != 0) { /* Valid */
/* ... */
}
} |
The assignment ipp = &ip is not safe because it allows the valid code that follows to reference the value of the volatile object i through the non-volatile-qualified reference ip. In this example, the compiler may optimize out the entire if block because i *ip != 0 must be false if i the object to which ip points is not volatile.
Implementation Details
...
In this compliant solution, ip is declared volatile:
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stdio.h>
void func(void) {
static volatile int **ipp;
static volatile int *ip;
static volatile int i = 0;
printf("i = %d.\n", i);
ipp = &ip;
*ipp = &i;
if (*ip != 0) {
/* ... */
}
} |
Risk Assessment
Casting away volatile allows access to Accessing an object with a volatile-qualified type through a nonvolatile reference and can result in undefined and perhaps unintended program reference with a non-volatile-qualified type is undefined behavior.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP32-C | Low | Likely | Medium | P6 | L2 |
...
Bibliography
| [ISO/IEC 9899:2011] | Subclause 6.7.3, "Type Qualifiers" |
...