Abstract data types are not restricted to object-oriented languages such as C++ and Java. They should be created and used in C language programs as well. Abstract data types are most effective when used with private (opaque) data types and information hiding.
Noncompliant Code Example
This noncompliant code example is based on the managed string library developed by CERT [Burch 2006]. In this example, the managed string type and the functions that operate on this type are defined in the
string_m.h header file as follows:
The implementation of the
string_mx type is fully visible to the user of the data type after including the
string_m.h file. Programmers are consequently more likely to directly manipulate the fields within the structure, violating the software engineering principles of information hiding and data encapsulation and increasing the probability of developing incorrect or nonportable code.
This compliant solution reimplements the
string_mx type as a private type, hiding the implementation of the data type from the user of the managed string library. To accomplish this, the developer of the private data type creates two header files: an external
string_m.h header file that is included by the user of the data type and an internal file that is included only in files that implement the managed string abstract data type.
In the external
string_m.h file, the
string_mx type is defined to be an instance of
struct string_mx, which in turn is declared as an incomplete type:
In the internal header file,
struct string_mx is fully defined but not visible to a user of the data abstraction:
Modules that implement the abstract data type include both the external and internal definitions, whereas users of the data abstraction include only the external
string_m.h file. This allows the implementation of the
string_mx data type to remain private.
The use of opaque abstract data types, though not essential to secure programming, can significantly reduce the number of defects and vulnerabilities introduced in code, particularly during ongoing maintenance.
|Axivion Bauhaus Suite|
|LDRA tool suite|
|Polyspace Bug Finder|
|MISRA C:2012 Dir 4.8|
If a pointer to a structure or union is never dereferenced within a translation unit, then the implementation of the object should be hidden
|CERT_C-DCL12-a||If a pointer to a structure or union is never dereferenced within a translation unit, then the implementation of the object should be hidden|
Directive 4.8 (advisory)