...
Incorrectly using the sizeof operator to determine the size of an array can result in a buffer overflow, allowing the execution of arbitrary code.
Recommendation | Severity | Likelihood |
|---|
Detectable | Repairable | Priority | Level |
|---|---|---|---|
ARR01-C | High | Probable | No |
Yes |
P12 | L1 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| sizeof-array-parameter | Fully checked | ||||||
| Axivion Bauhaus Suite |
| CertC-ARR01 | Fully implemented | ||||||
| CodeSonar |
| LANG.TYPE.SAP | sizeof Array Parameter | ||||||
| Compass/ROSE |
Can detect violations of the recommendation but cannot distinguish between incomplete array declarations and pointer declarations | |||||||||
| Helix QAC |
| C1321 | |||||||
| Klocwork |
| CWARN.MEMSET.SIZEOF.PTR | Fully implemented | ||||||
| LDRA tool suite |
| 401 S | Fully implemented | ||||||
| Parasoft C/C++test |
| CERT_C-ARR01-a | Do not call 'sizeof' on a pointer type | |||||||
| PC-lint Plus |
| 682, 882 | Fully supported | ||||||
| Polyspace Bug Finder |
| Checks for:
|
sizeof operator can cause unintended resultsRec, fully covered. | |||||||
| Splint |
|
| PVS-Studio |
| V511, V512, V514, V568, V579, V604, V697, V1086 | |||||||
| RuleChecker |
| sizeof-array-parameter | Fully checked |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
|---|---|---|
| CERT C |
| CTR01-CPP. Do not apply the sizeof operator to a pointer when taking the size of an array |
| Prior to 2018-01-12: CERT: Unspecified Relationship | ||
| CWE 2.11 | CWE-467, Use of sizeof() on a pointer type | Prior to 2018-01-12: CERT: |
| ISO/IEC TS 17961 | Taking the size of a pointer to determine the size of the pointed-to type [sizeofptr] | Prior to 2018-01-12: CERT: Unspecified Relationship |
| MITRE CWE | CWE-569 | Prior to 2018-01-12: |
| MITRE CWE | CWE-783 | Prior to 2018-01-12: |
Bibliography
| [Drepper 2006] | Section 2.1.1, "Respecting Memory Bounds" |
| [ISO/IEC 9899:2011] | Subclause 6.5.3.4, "The sizeof and _Alignof Operators" |
...
...