Page History

The size_t type is the unsigned integer type of the result of the sizeof operator. Variables of type size_t are guaranteed to be of sufficient precision to represent the size of an object. The limit of size_t is specified by the SIZE_MAX macro.

Wiki MarkupThe type {{size_t}} generally covers the entire address space. ISO/IEC TR 24731-1-2007 introduces a new type {{rsize_t}}, defined to be {{size_t}} but explicitly used to hold the size of a single object \ [[Meyers 2004|AA. Bibliography#Meyers 2004]\]. In code that documents this purpose by using the type {{rsize_t}}, the size of an object can be checked to verify that it is no larger than {{RSIZE_MAX}}, the maximum size of a normal single object, which provides additional input validation for library functions. See recommendation [STR07-C. Use the bounds-checking interfaces for remediation of existing string manipulation code] for additional discussion of TR 24731-1.

Any variable that is used to represent the size of an object, including integer values used as sizes, indices, loop counters, and lengths, should be declared rsize_t, if available. Otherwise, it should be declared size_t.

...

sizeof(size_t) == sizeof(int)

Wiki MarkupThe unsigned {{n}} may contain a value greater than {{INT_MAX}}. Assuming quiet wraparound on signed overflow, the loop executes {{n}} times because the comparison {{i < n}} is an unsigned comparison. Once {{i}} is incremented beyond {{INT_MAX}}, {{i}} takes on negative values starting with ({{INT_MIN}}). Consequently, the memory locations referenced by {{p\[i\]}} precede the memory referenced by {{p}} and a write-outside-array bounds occurs.

sizeof(size_t) > sizeof(int)

...

For values of n where INT_MAX < n <= (size_t)INT_MIN, the loop executes INT_MAX times. Once i becomes negative the loop stops, and i remains in the range 0 through INT_MAX.unmigrated-wiki-markup

For values of {{n}} where {{(size_t)INT_MIN < n <= SIZE_MAX}}, {{i}} wraps and takes the values {{INT_MIN}} to {{INT_MIN + (n - (size_t)INT_MIN - 1)}}. Execution of the loop overwrites memory from {{p\[INT_MIN\]}} through {{p\[INT_MIN + (n - (size_t)INT_MIN - 1)\]}}.

Compliant Solution (TR 24731-1)

...

Automated Detection

...

ISO/IEC TR 24731-1:2007

Bibliography

Wiki Markup\[[Meyers 2004|AA. Bibliography#Meyers 2004]\]

...

      04. Integers (INT)