The C Standard, 6.7.34, paragraph 6 7 [ISO/IEC 9899:20112024], states
If an attempt is made to modify an object defined with a
const-qualified type through use of an lvalue with non-const-qualified type, the behavior is undefined.
See also undefined behavior 6461.
There are existing compiler implementations that allow const-qualified objects to be modified without generating a warning message.
...
Modifying constant objects through nonconstant references is undefined behavior 61.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
EXP40-C | Low | Unlikely | Yes | NoMedium | P2 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| assignment-to-non-modifiable-lvalue pointer-qualifier-cast-const pointer-qualifier-cast-const-implicit write-to-constant-memory | Fully checked | ||||||||||||||||
| Axivion Bauhaus Suite |
| CertC-EXP40 | |||||||||||||||||
| Coverity |
| PW MISRA C 2004 Rule 11.5 | Implemented | ||||||||||||||||
| Cppcheck Premium |
| premium-cert-exp40-c | |||||||||||||||||
| Helix QAC |
| C0563 | |||||||||||||||||
| LDRA tool suite |
| 582 S | Fully implemented | ||||||||||||||||
| Parasoft C/C++test |
| MISRA-11_5 | Fully implementedCERT_C-EXP40-a | A cast shall not remove any 'const' or 'volatile' qualification from the type of a pointer or reference | |||||||||||||||
| Polyspace Bug Finder |
| CERT C: Rule EXP40-C | Checks for write operations on const qualified objects (rule fully covered) | ||||||||||||||||
| RuleChecker |
| Writing to const qualified object | Object declared with a const qualifier is modified | PRQA QA-C | |||||||||||||||
| Include Page | PRQA QA-C_v | PRQA QA-C_v | 0563 | Partially implemented |
| assignment-to-non-modifiable-lvalue pointer-qualifier-cast-const pointer-qualifier-cast-const-implicit | Partially checked | ||||||||||||
| Security Reviewer - Static Reviewer |
| C73 | Fully implemented | ||||||||||||||||
| TrustInSoft Analyzer |
| mem_access | Exhaustively verified (see the compliant and the non-compliant example). |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
Bibliography
| [ISO/IEC 9899:20112024] | Subclause 6.7.34, "Type Qualifiers" |
...