Page History

...

This rule is a generalization of rule STR37-C. Arguments to character handling functions must be representable as an unsigned char.

...

The string variable is used to traverse the character string containing the command line to be parsed. As characters are retrieved from this pointer, they are stored in a variable of type int. For compilers in which the char type defaults to signed char, this value is sign-extended when assigned to the int variable. For character code 255 decimal (-1 −1 in two's complement form), this sign extension results in the value -1 −1 being assigned to the integer, which is indistinguishable from EOF.

...

static int yy_string_get() {
  register unsigned char *string;
  register int c;

  string = bash_input.location.string;
  c = EOF;

  /* If the string doesn't exist, or is empty, EOF found. */
  if (string && *string) {
    c = *string++;
    bash_input.location.string = string;
  }
  return (c);
}

This solutionexample, however, is in violation of recommendation STR04-C. Use plain char for characters in the basic character set.

...

In this noncompliant example, the result of the cast of *s to unsigned int may result in a value in excess of UCHAR_MAX because of integer promotions, consequently causing the function to violate VOID Guarantee that array indices are within the valid range, leading to undefined behavior.

static const char table[UCHAR_MAX] = { /* ... /* };

int first_not_in_table(const char *str) {
  const char *s = str;
  for (; *s; ++s) {
    if (table[(unsigned)*s] != *s)
      return s - str;
  return -1;
}

...

static const char table[UCHAR_MAX] = { /* ... /* };

ptrdiff_t first_not_in_table(const char *str) {
  const char *s = str;
  for (; *s; ++s) {
    if (table[(unsigned char)*s] != *s)
      return s - str;
  return -1;
}

...

Related Vulnerabilities

CVE-2009-0887 results from a violation of this rule. In Linux PAM (up to version 1.0.3), the libpam implementation of strtok casts a (potentially signed) character to an integer, for use as an index to an array. An attacker can exploit this by inputting a string with non-ASCII characters, causing the cast to result in a negative index and accessing memory outside of the array [xorl 2009].

...

CERT C++ Secure Coding Standard: STR34-CPP. Cast characters to unsigned types before converting to larger integer sizes

ISO/IEC 9899:19992011 Section 6.2.5, "Types"

ISO/IEC TR 17961 (Draft) Conversion of signed characters to wider integer types before a check for EOF [signconv]

MISRA Rule 6.1, "The plain char type shall be used only for the storage and use of character values."

...