Page History

...

When compiled for Windows (x86), the output of this program is:
Size of struct: 16 bytes

Non-Compliant Coding Example

This non-compliant example demonstrates the incorrect way to declare a jagged array of 100 x 100 integers.

/* assuming 32-bit pointer, 32-bit integer */
int i;
int** intarray = calloc(100, 4);
for (i = 0; i < 100; i++)
    intarray[i] = calloc(100, 4);

Compliant Solution

The above example can be fixed by replacing the hard-coded value 4 with the actual size of the datatype as represented on the target platform. Remember to check the return value of the memory allocation routines.

int i;
int** intarray = calloc(100, sizeof(int*));
if (!intarray)
    { /* perform cleanup, return error */ }
for (i = 0; i < 100; i++) {
    intarray[i] = calloc(100, sizeof(int));
    if (!intarray[i])
        { /* perform cleanup, return error */ }
}

Risk Assessment

If non-compliant code is ported to a different platform, it could introduce a heap or stack overflow vulnerability.