According to C99 [ISO/IEC 9899:1999], Section 6.7.3, "Type qualifiers," Paragraph 5
If an attempt is made to modify an object defined with a
const-qualified type through use of an lvalue with non-const-qualified type, the behavior is undefined.
(See also undefined behavior 61 of Appendix J.)
There are existing compiler implementations that allow const-qualified values to be modified without generating a warning message.
It is also a recommended practice not to cast away a const qualification (as in recommendation EXP05-C. Do not cast away a const qualification) because doing so makes it easier to modify a const-qualified value without warning.
Noncompliant Code Example
The following well-formed but noncompliant code example borrowed from section 6.5.16.1 of C99 allows a constant value to be modified.
char const **cpp; char *cp; char const c = 'A'; cpp = &cp; /* constraint violation */ *cpp = &c; /* valid */ *cp = 'B'; /* valid */
The first assignment is unsafe because it would allow the valid code that follows to attempt to change the value of the const object c.
Noncompliant Code Example (Modifying a String Literal)
Similarly to the previous example, the well-formed but noncompliant code example below modifies a constant object after casting away its constness. Compiling the program on a Linux/x64 system doesn't produce any diagnostics even at high warning levels but the generated executable program fails at runtime with SIGESGV.
const char s[] = "foo";
int main() {
*(char*)s = '\0';
}
Implementation-Specific Details
If cpp, cp, and c are declared as automatic (stack) variables, this example compiles without warning on Microsoft Visual C++ .NET (2003) and on MS Visual Studio 2005. In both cases, the resulting program changes the value of c. MS Visual Studio 2008 generates an error message. Version 3.2.2 of the GCC compiler generates a warning but compiles. The resulting program changes the value of c.
If cpp, cp, and c are declared with static storage duration, this program terminates abnormally for both MS Visual Studio and GCC Version 3.2.2.
Compliant Solution
The compliant solution depends on the intention of the programmer. If the intention is that the value of c is modifiable, then it should not be declared as a constant. If the intention is that the value of c is not meant to change, then do not write noncompliant code that attempts to modify it.
Risk Assessment
Modifying constant objects through non-constant references results in undefined behavior.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
EXP40-C |
low |
unlikely |
medium |
P2 |
L3 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
ISO/IEC 9899:1999 Section 6.7.3, "Type qualifiers," and Section 6.5.16.1, "Simple assignment"
Bibliography
EXP40-C. Do not modify constant values EXP40-C. Do not modify constant values EXP41-C. Do not add or subtract a scaled integer to a pointer