EXP40-C. Do not modify constant objects

The C Standard, subclause 6.7.3, paragraph 6 [ISO/IEC 9899:2011], states:

If an attempt is made to modify an object defined with a const-qualified type through use of an lvalue with non-const-qualified type, the behavior is undefined.

(See also undefined behavior 64 in Appendix J of the C Standard.)

There are existing compiler implementations that allow const-qualified values to be modified without generating a warning message.

Avoid casting away const qualification because doing so makes it easier to modify const-qualified values without issuing diagnostics.  See EXP05-C. Do not cast away a const qualification for more details.

Noncompliant Code Example

The following well-formed, but noncompliant, code example specified in subclause 6.5.16.1 of the C Standard allows a constant value to be modified:

const char **cpp;
char *p;
const char c = 'A';

void func(void) {
  cpp = &p; /* Constraint violation */
  *cpp = &c; /* Valid */
  *p = 0; /* Valid */
}

The first assignment is unsafe because it would allow the valid code that follows to attempt to change the value of the const object c.

Implementation Details

If cpp, p, and c are declared as automatic variables, this example compiles without warning with Microsoft Visual Studio 2012 when compiled in C mode (/TC) and the resulting program changes the value of c. GCC 4.8.1 generates a warning but compiles, and the resulting program changes the value of c.

If cpp, p, and c are declared with static storage duration, this program compiles without warning and terminates abnormally with Microsoft Visual Studio 2012, and compiles with warning and terminates abnormally with GCC 4.8.1.

Compliant Solution

The compliant solution depends on the intent of the programmer. If the intent is that the value of c is modifiable, then it should not be declared as a constant, as in this compliant solution:

char **cpp;
char *p;
char c = 'A';

void func(void) {
  cpp = &p; /* Constraint violation */
  *cpp = &c; /* Valid */
  *p = 0; /* Valid */
}

If the intent is that the value of c is not meant to change, then do not write noncompliant code that attempts to modify it.  This may require relying on additional analysis tools to catch constraint violations in cases where the compiler does not emit a diagnostic.

Noncompliant Code Example

The following well-formed, but noncompliant, code example modifies a constant object after casting away its const qualifier.

const char s[] = "foo";
void func(void) {
  *(char *)s = '\0';
}

Compliant Solution

Similar to the previous compliant solution, this compliant solution depends on the intent of the programmer.  If the intent is that s should be modifiable, then it should not be declared as a constant object.  If the intent is that s should not be modifiable, then the explicit cast and assignment operations are erroneous and should be removed.

char s[] = "foo";
void func(void) {
  *s = '\0';
}

Risk Assessment

Modifying constant objects through non-constant references results in undefined behavior.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography