Page History

...

Strangely, it's not illegal to apply a const or volatile qualifier to a type name that is of reference type. Rather than cause an error, the qualifier...can be ignored.

Noncompliant Code Example

char c = 'c';
char &const p = c;
p = 'p';
cout << c << endl;

Implementation Details

On Microsoft Visual C++, this code compiles without incident and outputs:

...

: error: 'const' qualifiers cannot be applied to 'char&'

Compliant Solution

If constant access is required, instead of using a const reference, one can use a const pointer:

char c = 'c';
char *const p = c;
*p = 'p'; // causes compiler error
cout << c << endl;

Risk Assessment

Const and volatile references may be freely ignored by the compiler, causing unexpected values to be stored and leading to possible data integrity violations.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[Dewhurst 02|AA. C++ References#Dewhurst 02]\] Gotcha #5, "Misunderstanding References"

...