Page History

...

Type alignment requirements can also affect the size of structures. For example, the size of the following structure is implementation-defined:

Code Block
struct s { int i; double d; };

Assuming 32-bit integers and 64-bit doubles, for example, the size can range from 12 or 12 to 16 bytes, depending on alignment rules.

...

Code Block

bgColor	#FFcccc
lang	c


int f(void) { /* assumingAssuming 32-bit pointer, 32-bit integer */
  size_t i;
  int **matrix = (int **)calloc(100, 4);
  if (matrix == NULL) {
    return -1; /* Indicate handlecalloc() errorfailure */
  }

  for (i = 0; i < 100; i++) {
    matrix[i] = (int *)calloc(i, 4);
    if (matrix[i] == NULL) {
      return -1; /* Indicate handlecalloc() errorfailure */
    }
  }
 return 0;
}

Compliant Solution

This compliant solution replaces the hard-coded value 4 with sizeof(int *).:

Code Block

bgColor	#ccccff
lang	c

int f(void) {
  size_t i;
  int **matrix = (int **)calloc(100, sizeof(*matrix));
  if (matrix == NULL) {
    return -1; /* Indicate handlecalloc() errorfailure */
  }

  for (i = 0; i < 100; i++) {
    matrix[i] = (int *)calloc(i, sizeof(**matrix));
    if (matrix[i] == NULL) {
      return -1; /* Indicate handlecalloc() errorfailure */
    }
  }

  return 0;
}

Also see recommendation MEM02-C. Immediately cast the result of a memory allocation function call into a pointer to the allocated type for a discussion on the use of the sizeof operator with memory allocation functions.

Exceptions

EXP09-C-EX1: C99 explicitly The C Standard explicitly declares sizeof(char) == 1. So , so any sizes based on characters or character arrays may be evaluated without using sizeof. This does not apply to char* or any other data types.

...

Porting code with hard-coded sizes can result in a buffer overflow or related vulnerability.

Recommendation	Severity	Likelihood	Detectable

Remediation Cost

Repairable	Priority	Level
EXP09-C	High

high

Unlikely

unlikely

No

medium

Yes

P6

L2

Automated Detection

Tool	Version	Checker	Description

section

Astrée

Include Page

	Astrée_V
	Astrée_V

alloc-without-sizeof

Partially checked

Compass/ROSE

Sectioncan

Can detect violations of this recommendation. In particular, it looks for the size argument of malloc(), calloc(), or realloc()

,

and flags when it does not find a sizeof operator in the argument expression. It does not flag if the return value is assigned to a char *

,

; in this case a string is being allocated, and sizeof is unnecessary because sizeof(char) == 1

ECLAIR

Include Page

	ECLAIR_V
	ECLAIR_V

CC2.EXP09

Can detect violations of this recommendation. In particular, it considers when the size of a type is used by malloc(), calloc() or realloc() and flags these functions if either the size argument does not use a sizeof operator, or the size argument uses sizeof, but the type of the returned value is not a pointer to the type of the argument to sizeof. It does not flag if the returned value is assigned to a char *

Helix QAC

Include Page