Page History

...

Type alignment requirements can also affect the size of structures. For example, the size of the following structure is implementation-defined:

struct s {
   int i;
   double d;
};

Assuming 32-bit integers and 64-bit doubles, for example, the size can range from 12 or 12 to 16 bytes, depending on alignment rules.

...

Noncompliant Code Example

This non-compliant noncompliant code example attempts to declare a two-dimensional array of integers with variable length rows. On a platform with 64-bit integers, the loop will access memory outside the allocated memory section.

int f(void) { 
/* assumingAssuming 32-bit pointer, 32-bit integer */
  size_t i;
  int **matrix = (int **)calloc(100, 4);
  if (matrix == NULL) {
    return -1; /* handle errorIndicate calloc() failure */
  }

  for (i = 0; i < 100; i++) {
    matrix[i] = (int *)calloc(i, 4);
    if (matrix[i] == NULL) {
      return -1; /* handle errorIndicate calloc() failure */
    }
  }
 return 0;
}

Compliant Solution

This compliant solution replaces the hard-coded value 4 with sizeof(int *).:

int f(void) {
  size_t i;
  int **matrix = (int **)calloc(100, sizeof(int *matrix));
  if (matrix == NULL) {
    return -1; /* handle errorIndicate calloc() failure */
  }

  for (i = 0; i < 100; i++) {
    matrix[i] = (int *)calloc(i, sizeof(int**matrix));
    if (matrix[i] == NULL) {
      return -1; /* handle errorIndicate calloc() failure */
    }
  }

  return 0;
}

Also see MEM02-AC. Immediately cast the result of a memory allocation function call into a pointer to the allocated type for a discussion on the use of the sizeof operator with memory allocation functions.

Exceptions

EXP09-C-EX1: The C Standard explicitly declares sizeof(char) == 1, so any sizes based on characters or character arrays may be evaluated without using sizeof. This does not apply to char* or any other data types.

Risk Assessment

If non-compliant code is ported to a different platform, it could introduce a buffer or stack overflow Porting code with hard-coded sizes can result in a buffer overflow or related vulnerability.

Automated Detection

...

...

...

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.2.6, "Representations of types," and Section 6.5.3.4, "The sizeof operator"

Related Guidelines

...

Image Added Image Added Image AddedEXP08-A. Ensure pointer arithmetic is used correctly      03. Expressions (EXP)       EXP10-A. Do not depend on the order of evaluation of subexpressions or the order in which side effects take place