Signed character data must be converted to an unsigned type before being assigned or converted to a larger signed type. Because compilers have the latitude to define char
to have the same range, representation, and behavior as either signed char
or unsigned char
, this rule should be applied to both signed char
and (plain) char
characters.
This rule is only applicable in cases where the character data may contain values that can be interpreted as negative values. For example, if the char
type is represented by a two's complement 8-bit value, any character value greater than +127 is interpreted as a negative value.
This noncompliant code example is taken from a vulnerability in bash versions 1.14.6 and earlier that resulted in the release of CERT Advisory CA-1996-22. This vulnerability resulted from the sign extension of character data referenced by the string
pointer in the yy_string_get()
function in the parse.y
module of the bash source code:
static int yy_string_get() { register char *string; register int c; string = bash_input.location.string; c = EOF; /* If the string doesn't exist, or is empty, EOF found. */ if (string && *string) { c = *string++; bash_input.location.string = string; } return (c); } |
The string
variable is used to traverse the character string containing the command line to be parsed. As characters are retrieved from this pointer, they are stored in a variable of type int
. For compilers in which the char
type defaults to signed char
, this value is sign-extended when assigned to the int
variable. For character code 255 decimal (-1 in two's complement form), this sign extension results in the value -1 being assigned to the integer, which is indistinguishable from EOF
.
This problem was repaired by explicitly declaring the string
variable as unsigned char
.
static int yy_string_get() { register unsigned char *string; register int c; string = bash_input.location.string; c = EOF; /* If the string doesn't exist, or is empty, EOF found. */ if (string && *string) { c = *string++; bash_input.location.string = string; } return (c); } |
This solution, however, is in violation of STR04-C. Use plain char for characters in the basic character set.
In this compliant solution, the result of the expression *string++
is cast to (unsigned char)
before assignment to the int
variable c
.
static int yy_string_get() { register char *string; register int c; string = bash_input.location.string; c = EOF; /* If the string doesn't exist, or is empty, EOF found. */ if (string && *string) { /* cast to unsigned type */ c = (unsigned char)*string++; bash_input.location.string = string; } return (c); } |
This is a subtle error that results in a disturbingly broad range of potentially severe vulnerabilities.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
STR34-C |
medium |
probable |
medium |
P8 |
L2 |
The LDRA tool suite V 7.6.0 can detect violations of this rule.
Fortify SCA Version 5.0 with CERT C Rule Pack can detect violations of this rule.
Compass/ROSE can detect violations of this rule when checking for violations of INT07-C. Use only explicitly signed or unsigned char type for numeric values.
[CVE-2009-0887|http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0887] results from a violation of this rule. In Linux PAM (up to version 1.0.3), the {{libpam}} implementation of strtok casts a (potentially signed) character to an integer, for use as an index to an array. An attacker can exploit this by inputting a string with non-ASCII characters, causing the cast to result in a negative index and accessing memory outside of the array \[[xorl 2009|http://xorl.wordpress.com/2009/03/26/cve-2009-0887-linux-pam-singedness-issue/]\]. |
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
This rule appears in the C++ Secure Coding Standard as STR34-CPP. Cast characters to unsigned types before converting to larger integer sizes.
\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.2.5, "Types" \[[MISRA 04|AA. C References#MISRA 04]\] Rule 6.1, "The plain char type shall be used only for the storage and use of character values." \[[MITRE 07|AA. C References#MITRE 07]\] [CWE ID 704|http://cwe.mitre.org/data/definitions/704.html], "Incorrect Type Conversion or Cast" \[[xorl 2009|C References#xorl 2009]\] ["CVE-2009-0887: Linux-PAM Singedness Issue"|http://xorl.wordpress.com/2009/03/26/cve-2009-0887-linux-pam-singedness-issue/] |
STR33-C. Size wide character strings correctly 07. Characters and Strings (STR) STR35-C. Do not copy data from an unbounded source to a fixed-length array