Page History

...

Type alignment requirements can also affect the size of structures. For example, the size of the following structure is implementation-defined:

struct s {
  int i;
  double d;
};

Assuming 32-bit integers and 64-bit doubles, for example, the size can range from 12 or 12 to 16 bytes, depending on alignment rules.

...

This noncompliant code example attempts to declare a two-dimensional array of integers with variable length rows. On a platform with 64-bit integers, the loop will access memory outside the allocated memory section.

int f(void) { 
/* assumingAssuming 32-bit pointer, 32-bit integer */
  size_t i;
  int **matrix = (int **)calloc(100, 4);
  if (matrix == NULL) {
    return -1; /* handle errorIndicate calloc() failure */
  }

  for (i = 0; i < 100; i++) {
    matrix[i] = (int *)calloc(i, 4);
    if (matrix[i] == NULL) {
      return -1; /* handle errorIndicate calloc() failure */
    }
  }
 return 0;
}

Compliant Solution

This compliant solution replaces the hard-coded value 4 with sizeof(int *).:

int f(void) {
  size_t i;
  int **matrix = (int **)calloc(100, sizeof(*matrix));
  if (matrix == NULL) {
    return -1; /* handle errorIndicate calloc() failure */
  }

  for (i = 0; i < 100; i++) {
    matrix[i] = (int *)calloc(i, sizeof(**matrix));
    if (matrix[i] == NULL) {
      return -1; /* handle errorIndicate calloc() failure */
    }
  }

  return 0;
}

Also see MEM02-C. Immediately cast the result of a memory allocation function call into a pointer to the allocated type for a discussion on the use of the sizeof operator with memory allocation functions.

Exceptions

EXP09-C-EX1: C99 explicitly  The C Standard explicitly declares sizeof(char) == 1. So , so any sizes based on characters or character arrays may be evaluated without using sizeof. This does not apply to char* or any other data types.

...

Porting code with hard-coded sizes can result in a buffer overflow or related vulnerability.

Automated Detection

...

...

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

...

Related Guidelines

...

...

...

References

\[[ISO/IEC 9899:1999|AA. References#ISO/IEC 9899-1999]\] Section 6.2.6, "Representations of types," and Section 6.5.3.4, "The sizeof operator"
\[[MITRE|AA. References#MITRE]\] [CWE ID 805|http://cwe.mitre.org/data/definitions/805.html], "Buffer Access with Incorrect Length Value"

...

Image Added Image Added Image Removed      03. Expressions (EXP)      Image Modified