When performing pointer arithmetic, the size of the value to add to a pointer is automatically scaled to the size of the type of the pointed-to object. For instance, when adding a value to the byte address of a 4-byte integer, the value is scaled by a factor of 4 and then added to the pointer. Failing to understand how pointer arithmetic works can lead to miscalculations that result in serious errors, such as buffer overflows.
Noncompliant Code Example
In this noncompliant code example, integer values returned by
parseint(getdata()) are stored into an array of
INTBUFSIZE elements of type
buf [Dowd 2006]. If data is available for insertion into
buf (which is indicated by
buf_ptr has not been incremented past
buf + sizeof(buf), an integer value is stored at the address referenced by
buf_ptr. However, the
sizeof operator returns the total number of bytes in
buf, which is typically a multiple of the number of elements in
buf. This value is scaled to the size of an integer and added to
buf. As a result, the check to make sure integers are not written past the end of
buf is incorrect, and a buffer overflow is possible.
In this compliant solution, the size of
INTBUFSIZE, is added directly to
buf and used as an upper bound. The integer literal
INTBUFSIZE is scaled to the size of an integer, and the upper bound of
buf is checked correctly.
An arguably better solution is to use the address of the nonexistent element following the end of the array, as follows:
This solution works because the C Standard guarantees the address of
buf[INTBUFSIZE] even though no such element exists.
Noncompliant Code Example
This noncompliant code example is based on a flaw in the OpenBSD operating system. An integer,
skip, is added as an offset to a pointer of type
struct big. The adjusted pointer is then used as a destination address in a call to
memset(). However, when
skip is added to the
struct big pointer, it is automatically scaled by the size of
struct big, which is 32 bytes (assuming 4-byte integers, 8-byte
long long integers, and no structure padding). This scaling results in the call to
memset() writing to unintended memory.
A similar situation occurred in OpenBSD's
make command [Murenin 2007].
To correct this example, the
struct big pointer is cast as a
char *, which causes
skip to be scaled by a factor of 1:
Failure to understand and properly use pointer arithmetic can allow an attacker to execute arbitrary code.
|Supported: Astrée reports potential runtime errors resulting from invalid pointer arithmetics.|
|LDRA tool suite|
Pointer arithmetic should not be used
|Parasoft Insure++||Runtime analysis|
|Polyspace Bug Finder|
Implicit scaling in pointer arithmetic might be ignored
Pointer dereferenced outside its bounds
Standard library memory function called with invalid arguments
A pointer resulting from arithmetic on a pointer operand shall address an element of the same array as that pointer operand
Subtraction between pointers shall only be applied to pointers that address elements of the same array
The relational operators >, >=, < and <= shall not be applied to objects of pointer type except where they point into the same object
0488, 2930, 2931, 2932, 2933, 2934
|V503, V520, V574, V600, V613, V619, V620, V643, V650, V687, V769, V1004|
How long is 4 yards plus 3 feet? It is obvious from elementary arithmetic that any answer involving 7 is wrong, as the student did not take the units into account. The right method is to convert both numbers to reflect the same units.
The examples in this rule reflect both a correct and an incorrect way to handle comparisons of numbers representing different things (either single bytes or multibyte data structures). The noncompliant examples just add the numbers without regard to units, whereas the compliant solutions use type casts to convert one number to the appropriate unit of the other number.
ROSE can catch both noncompliant examples by searching for pointer arithmetic expressions involving different units. The "different units" is the tricky part, but you can try to identify an expression's units using some simple heuristics:
- A pointer to a
fooas the unit.
- A pointer to
char *has byte as the unit.
offsetofexpression also has unit byte as the unit.
- Any variable used in an index to an array of
fooas the unit.
In addition to pointer arithmetic expressions, you can also hunt for array index expressions, as
array[index] is merely shorthand for "
array + index."
|SEI CERT C++ Coding Standard||VOID EXP08-CPP. Ensure pointer arithmetic is used correctly|
|ISO/IEC TR 24772:2013||Pointer Casting and Pointer Type Changes [HFC]|
Pointer Arithmetic [RVG]
|ISO/IEC TS 17961||Forming or using out-of-bounds pointers or array subscripts [invptr]|
|MISRA C:2012||Rule 18.1 (required)|
Rule 18.2 (required)
Rule 18.3 (required)
Rule 18.4 (advisory)
|MITRE CWE||CWE-468, Incorrect pointer scaling|