Do not hard code the size of a type into an application. Because of alignment, padding, and differences in basic types (e.g., 32-bit versus 64-bit pointers), the size of most types can vary between compilers and even versions of the same compiler. Using the sizeof
operator to determine sizes improves the clarity of what is meant and ensures that changes between compilers or versions will not affect the code.
Type alignment requirements can also affect the size of structures. For example, the size of the following structure is implementation-defined:
struct s { int i; double d; }; |
Assuming 32-bit integers and 64-bit doubles, for example, the size can range from 12 to 16 bytes, depending on alignment rules.
This noncompliant code example attempts to declare a two-dimensional array of integers with variable length rows. On a platform with 64-bit integers, the loop will access memory outside the allocated memory section.
int f(void) { /* Assuming 32-bit pointer, 32-bit integer */ size_t i; int **matrix = (int **)calloc(100, 4); if (matrix == NULL) { return -1; /* Indicate calloc() failure */ } for (i = 0; i < 100; i++) { matrix[i] = (int *)calloc(i, 4); if (matrix[i] == NULL) { return -1; /* Indicate calloc() failure */ } } return 0; } |
This compliant solution replaces the hard-coded value 4
with sizeof(int *)
:
int f(void) { size_t i; int **matrix = (int **)calloc(100, sizeof(*matrix)); if (matrix == NULL) { return -1; /* Indicate calloc() failure */ } for (i = 0; i < 100; i++) { matrix[i] = (int *)calloc(i, sizeof(**matrix)); if (matrix[i] == NULL) { return -1; /* Indicate calloc() failure */ } } return 0; } |
Also see MEM02-C. Immediately cast the result of a memory allocation function call into a pointer to the allocated type for a discussion on the use of the sizeof
operator with memory allocation functions.
EXP09-C-EX1: The C Standard explicitly declares sizeof(char) == 1
, so any sizes based on characters or character arrays may be evaluated without using sizeof
. This does not apply to char*
or any other data types.
Porting code with hard-coded sizes can result in a buffer overflow or related vulnerability.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
EXP09-C | High | Unlikely | Medium | P6 | L2 |
Tool | Version | Checker | Description |
---|---|---|---|
Astrée | alloc-without-sizeof | Partially checked | |
Compass/ROSE | Can detect violations of this recommendation. In particular, it looks for the size argument of | ||
ECLAIR | CC2.EXP09 | Can detect violations of this recommendation. In particular, it considers when the size of a type is used by malloc() , calloc() or realloc() and flags these functions if either the size argument does not use a sizeof operator, or the size argument uses sizeof , but the type of the returned value is not a pointer to the type of the argument to sizeof . It does not flag if the returned value is assigned to a char * | |
LDRA tool suite | 201 S | Partially implemented | |
CERT C: Rec. EXP09-C | Checks for hard-coded object size used to manipulate memory (rec. fully covered) | ||
RuleChecker | alloc-without-sizeof | Partially checked |
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
SEI CERT C++ Coding Standard | VOID EXP09-CPP. Use sizeof to determine the size of a type or variable |
MITRE CWE | CWE-805, Buffer access with incorrect length value |