The sizeof operator yields the size (in bytes) of its operand, which may be an expression or the parenthesized name of a type. However, using the sizeof operator to determine the size of arrays is error prone.

Non-Compliant Code Example

Compliant Solution

Risk Assessment

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

ARR00-A

3 (high)

1 (unlikely)

3 (low)

P9

L2

References

\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.7.5.2, "Array declarators"
\[[Drepper 06|AA. C References#Drepper 06]\] Section 2.1.1, "Respecting Memory Bounds"