...
A standard-layout class is a class that:
— has no non-static data members of type non-standard-layout class (or array of such types) or reference,
— has no virtual functions and no virtual base classes,
— has the same access control for all non-static data members,
— has no non-standard-layout base classes,
— either has no non-static data members in the most derived class and at most one base class with non-static data members, or has no base classes with non-static data members, and
— has no base classes of the same type as the first non-static data member.
Do not use std::memset() to initialize an object of nontrivial class type as it may not properly initialize the value representation of the object. Do not use std::memcpy() (or related bytewise copy functions) to initialize a copy of an object of nontrivial class type, as it may not properly initialize the value representation of the copy. Do not use std::memcmp() (or related bytewise comparison functions) to compare objects of nonstandard-layout class type, as it may not properly compare the value representations of the objects. In all cases, it is best to prefer the alternatives.
...
Most violations of this rule will result in abnormal program behavior. However, overwriting implementation details of the object representation can lead to code execution vulnerabilities.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
OOP57-CPP | High | Probable | Yes | NoHigh | P6P12 | L2L1 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| stdlib-use-ato stdlib-use stdlib-use-getenv stdlib-use-system include-time stdlib-use-string-unbounded | Partially checked | ||||||
| CodeSonar |
| BADFUNC.MEMCMP BADFUNC.MEMSET | Use of memcmp Use of memset | ||||||
| Helix QAC |
| C++5017, C++5038 | |||||||
| Klocwork |
| CERT.OOP.CSTD_FUNC_USE | |||||||
| LDRA tool suite |
| 44 S | Enhanced Enforcement | ||||||
| Parasoft C/C++test |
| CERT_CPP-OOP57-a | Do not initialize objects with a non-trivial class type using C standard library functions | ||||||
| Polyspace Bug Finder |
| CERT C++: OOP57-CPP | Checks for bytewise operations on nontrivial class object (rule fully covered) | ||||||
| PVS-Studio |
| V598, V780 | |||||||
| RuleChecker |
| stdlib-use-ato stdlib-use stdlib-use-getenv stdlib-use-system include-time stdlib-use-string-unbounded | Partially checked |
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
...