Page History

C++ does not allow you to change the value of a reference type, effectively treating all references as being const qualified. The C++ Standard, [dcl.ref], paragraph 1 [ISO/IEC 14882-2014], states the following:

Cv-qualified references are ill-formed except when the cv-qualifiers are introduced through the use of a typedef-name (7.1.3, 14.1) or decltype-specifier (7.1.6.2), in which case the cv-qualifiers are ignored.

...

When attempting to const-qualify a type as part of a declaration that uses reference type, a programmer may accidentally write:

char &const p;

instead of:

char const &p; // Or: const char &p;

...

In this noncompliant code example, a const-qualified reference to a char is formed , instead of a reference to a const-qualified char. This results in undefined behavior:.

#include <iostream>
 
void f(char c) {
  char &const p = c;
  p = 'p';
  std::cout << c << std::endl;
}

Implementation Details (MSVC)

With Microsoft Visual Studio 2015, this code compiles successfully with a warning diagnostic:.

warning C4227: anachronism used : qualifiers on reference are ignored

When run, the code outputs the following.

p

Implementation Details (Clang)

With Clang 3.9, this code produces a fatal diagnostic:.

error: 'const' qualifier may not be applied to a reference

...

This noncompliant code example correctly declares p to be a reference to a const-qualified char. The subsequent modification of p makes the program ill-formed.

#include <iostream>
 
void f(char c) {
  const char &p = c;
  p = 'p'; // Error: read-only variable is not assignable
  std::cout << c << std::endl;
}

...

#include <iostream>
 
void f(char c) {
  char &p = c;
  p = 'p';
  std::cout << c << std::endl;
}

Risk Assessment

A const and  or volatile reference types type may result in undefined behavior instead of a fatal diagnostic, causing unexpected values to be stored and leading to possible data integrity violations.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Bibliography

...

...

Image Modified Image Modified Image Modified