The C Standard, 6.7.34, paragraph 6 7 [ISO/IEC 9899:20112024], states:
If an attempt is made to modify an object defined with a
const-qualified type through use of an lvalue with non-const-qualified type, the behavior is undefined.
See also undefined behavior 6461.
There are existing compiler implementations that allow const-qualified objects to be modified without generating a warning message.
Avoid casting away const qualification because doing so makes it possible to modify const-qualified objects without issuing diagnostics. (see See EXP05-C. Do not cast away a const qualification and STR30-C. Do not attempt to modify string literals for more details.).
Noncompliant Code Example
...
Modifying constant objects through nonconstant references is undefined behavior 61.
Rule | Severity | Likelihood | Detectable |
|---|
Repairable | Priority | Level | |
|---|---|---|---|
EXP40-C | Low | Unlikely | Yes |
No | P2 | L3 |
Automated Detection
...
Tool | Version | Checker | Description |
|---|
| Astrée |
| assignment-to-non-modifiable-lvalue pointer-qualifier-cast-const pointer-qualifier-cast-const-implicit write-to-constant-memory | Fully checked | ||||||
| Axivion Bauhaus Suite |
| CertC-EXP40 | |||||||
| Coverity |
| PW MISRA C 2004 Rule 11.5 | Implemented | ||||||
| Cppcheck Premium |
| premium-cert-exp40-c | |||||||
| Helix QAC |
| C0563 | |||||||
| LDRA tool suite |
| 582 S | Fully implemented | ||||||
| Parasoft C/C++test |
| CERT_C-EXP40-a | A cast shall not remove any 'const' or 'volatile' qualification from the type of a pointer or reference | ||||||
| Polyspace Bug Finder |
| CERT C: Rule EXP40-C | Checks for write operations on const qualified objects (rule fully covered) | ||||||
| RuleChecker |
| assignment-to-non-modifiable-lvalue pointer-qualifier-cast-const pointer-qualifier-cast-const-implicit | Partially checked | ||||||
| TrustInSoft Analyzer |
| mem_access | Exhaustively verified (see the compliant and the non-compliant example). |
0563
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
|---|---|---|
| CERT C Secure Coding Standard | EXP05-C. Do not cast away a const qualification | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT C Secure Coding Standard | STR30-C. Do not attempt to modify string literals | Prior to 2018-01-12: CERT: Unspecified Relationship |
Bibliography
...
...