Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

When transferring data between systems of different endianness, the programmer must take care to reverse the byte ordering before they interpret before interpreting the data.

The functions htonl(), htons(), ntohl(), and ntohs() can be used to transfer between network byte ordering (big endian) and the host's byte ordering. On big endian systems, these functions do nothing. They may also be implemented as macros rather than functions.

...

Noncompliant Code Example

In this noncompliant code example, the programmer tries to read an unsigned 32-bit integer off a previously connected network socket.

It is important to know the sizes of your data types lest they be different on architectures that are accessible over the network. Hence, we transfer a uint32_t rather than an int. For more information, see recommendation FIO09-C. Be careful with binary data when transferring data across systems.

Code Block
bgColor#FFcccc
langc

/* sock is a connected TCP socket */

uint32_t num;

if (recv(sock, (void *)&num, sizeof(uint32_t), 0) < 0) {
  /* Handle error */
}

printf("We received %u from the network!\n", (unsigned int)num);

...

Code Block
bgColor#ccccff
langc

/* sock is a connected TCP socket */

uint32_t num;

if (recv(sock, (void *)&num, sizeof(uint32_t), 0) < 0) {
  /* Handle error */
}

num = ntohl(num);
printf("We recieved %u from the network!\n", (unsigned int)num);

The ntohl() function (network to host long) translates a uint32_t value into the host byte ordering from the network byte ordering. This function is always appropriate to use because its implementation depends upon on the specific systems system's byte ordering. Consequently, on a big endian architecture, ntohl() does nothing.

The reciprocal function htonl() (host to network long) should be used before sending any data to another system over network protocols.

Portability Details

...

  • ntohs(), ntohl(), htons(), and htonl() are not part of the C standard Standard and are , consequently , not guaranteed to be portable to non-POSIX systems.
  • The POSIX implementations of ntohs(), ntohl(), htons(), and htonl() take arguments of types uint16_t and uint32_t and can be found in the header file <arpa/inet.h>.
  • The Windows implementations use unsigned short and unsigned long and can be found in the header file <winsock2.h>.
  • Other variants of ntoht() and htont() may exist on some systems, such as ntohi()/htoni() or ntohll()/htonll(), may exist on some systems.

Risk Assessment

If the programmer is careless, this bug is likely. However, it will immediately break the program by printing the incorrect result and , therefore , should be caught by the programmer during the early stages of debugging and testing. Recognizing a value as in reversed byte ordering, however, can be difficult depending on the type and magnitude of the data.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

POS39-C

medium

likely

low

P18

L1

 

...

Sources

[MSDN] "Winsock functions"
[Open Group 2004] htonl, htons, ntohl, ntohs - convert values between host and network byte order

...