Pointer arithmetic is appropriate only when the pointer argument refers to an array (see ARR37-C. Do not add or subtract an integer to a pointer to a non-array object), including an array of bytes. When performing pointer arithmetic, the size of the value to add to or subtract from a pointer is automatically scaled to the size of the type of the referenced array object. Adding or subtracting a scaled integer value to or from a pointer is invalid because it may yield a pointer that does not point to an element within or one past the end of the array. (See ARR30-C. Do not form or use out-of-bounds pointers or array subscripts.)
+Adding a pointer to an array of a type other than character to the result of the sizeof
operator or offsetof
macro, which returns a size and an offset, respectively, violates this rule. However, adding an array pointer to the number of array elements, for example, by using the arr[sizeof(arr)/sizeof(arr[0])])
idiom, is allowed provided that arr
refers to an array and not a pointer.
In this noncompliant code example, sizeof(buf)
is added to the array buf
. This example is noncompliant because sizeof(buf)
is scaled by int
and then scaled again when added to buf
.
This compliant solution uses an unscaled integer to obtain a pointer to the end of the array:
+In this noncompliant code example, skip
is added to the pointer s
. However, skip
represents the byte offset of ull_b
in struct big
. When added to s
, skip
is scaled by the size of struct big
.
This compliant solution uses an unsigned char *
to calculate the offset instead of using a struct big *
, which would result in scaled arithmetic:
In this noncompliant code example, wcslen(error_msg) * sizeof(wchar_t)
bytes are scaled by the size of wchar_t
when added to error_msg
:
This compliant solution does not scale the length of the string; wcslen()
returns the number of characters and the addition to error_msg
is scaled:
Failure to understand and properly use pointer arithmetic can allow an attacker to execute arbitrary code.
++ Rule + | ++ Severity + | ++ Likelihood + | ++ Remediation Cost + | ++ Priority + | ++ Level + | +
---|---|---|---|---|---|
+ ARR39-C + | ++ High + | ++ Probable + | ++ High + | ++ P6 + | ++ L2 + | +
+ Tool + | ++ Version + | ++ Checker + | ++ Description + | +
---|---|---|---|
+ + Astrée + + | ++ 22.04 + | ++ scaled-pointer-arithmetic + | ++ Partially checked + Besides direct rule violations, Astrée reports all (resulting) out-of-bound array accesses. + | +
+ + Axivion Bauhaus Suite + + | ++ 7.2.0 + | ++ CertC-ARR39 + | ++ Fully implemented + | +
+ + CodeSonar + + | ++ 7.1p0 + | ++ LANG.MEM.BO + LANG.MEM.BU + LANG.MEM.TBA + LANG.MEM.TO + LANG.MEM.TULANG.STRUCT.PARITH + LANG.STRUCT.PBB + LANG.STRUCT.PPE + BADFUNC.BO.* + | ++ Buffer overrun + Buffer underrun + Tainted buffer access + Type overrun + Type underrun + Pointer Arithmetic + Pointer before beginning of object + Pointer past end of object + A collection of warning classes that report uses of library functions prone to internal buffer overflows. + | +
+ + Coverity + + | ++ 2017.07 + | ++ BAD_SIZEOF + | ++ Partially implemented + | +
+ + Helix QAC + + | ++ 2022.2 + | ++ C4955, C4956, C4957 + C++4955, C++4956, C++4957 + | ++ | +
+ + Klocwork + + | ++ 2022.2 + | ++ MISRA.PTR.ARITH.2012 + | ++ | +
+ + LDRA tool suite + + | ++ 9.7.1 + | ++ 47 S, 489 S, 567 S,64 X, 66 X, 68 X,69 X, 70 X, 71 X + | ++ Partially implemented + | +
+ + Parasoft C/C++test + + | ++ 2022.1 + | ++ CERT_C-ARR39-a + CERT_C-ARR39-b + CERT_C-ARR39-c + | ++ Avoid accessing arrays out of bounds + Pointer arithmetic should not be used + Do not add or subtract a scaled integer to a pointer + | +
+ Polyspace Bug Finder + | ++ R2022a + | ++ + CERT C: Rule ARR39-C + + | ++ Checks for: + Incorrect pointer scalingncorrect pointer scaling, pointer access out of boundsointer access out of bounds, possible misuse of sizeofossible misuse of sizeof. + Rule partially covered. + | +
+ + PRQA QA-C + + | ++ 9.7 + | ++ 4955, 4956, 4957 + | ++ | +
+ + PRQA QA-C++ + + | ++ 4.4 + | ++ 4955, 4956, 4957 + | ++ | +
+ + RuleChecker + + | ++ 22.04 + | ++ scaled-pointer-arithmetic + | ++ Partially checked + | +
+ + TrustInSoft Analyzer + + | ++ 1.38 + | ++ index_in_address + | ++ Exhaustively detects undefined behavior (see + + one compliant and one non-compliant example + + ). + | +
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
+Key here (explains table format and definitions)
++ Taxonomy + | ++ Taxonomy item + | ++ Relationship + | +
---|---|---|
+ + CERT C Secure Coding Standard + + | ++ + ARR30-C. Do not form or use out-of-bounds pointers or array subscripts + + | ++ Prior to 2018-01-12: CERT: Unspecified Relationship + | +
+ + CERT C Secure Coding Standard + + | ++ + ARR37-C. Do not add or subtract an integer to a pointer to a non-array object + + | ++ Prior to 2018-01-12: CERT: Unspecified Relationship + | +
+ + ISO/IEC TR 24772:2013 + + | ++ Pointer Casting and Pointer Type Changes [HFC] + | ++ Prior to 2018-01-12: CERT: Unspecified Relationship + | +
+ + ISO/IEC TR 24772:2013 + + | ++ Pointer Arithmetic [RVG] + | ++ Prior to 2018-01-12: CERT: Unspecified Relationship + | +
+ + MISRA C:2012 + + | ++ Rule 18.1 (required) + | ++ Prior to 2018-01-12: CERT: Unspecified Relationship + | +
+ + MISRA C:2012 + + | ++ Rule 18.2 (required) + | ++ Prior to 2018-01-12: CERT: Unspecified Relationship + | +
+ + MISRA C:2012 + + | ++ Rule 18.3 (required) + | ++ Prior to 2018-01-12: CERT: Unspecified Relationship + | +
+ + MISRA C:2012 + + | ++ Rule 18.4 (advisory) + | ++ Prior to 2018-01-12: CERT: Unspecified Relationship + | +
+ + CWE 2.11 + + | ++ + CWE-468 + + , Incorrect Pointer Scaling + | ++ 2017-07-07: CERT: Exact + | +
+ [ + + Dowd 2006 + + ] + | ++ Chapter 6, "C Language Issues" + | +
+ [ + + Murenin 07 + + ] + | ++ | +
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
CON30-C | Medium | Unlikely | Medium | P4 | L3 |
Tool | Version | Checker | Description |
---|---|---|---|
Astrée | 22.04 | Supported, but no explicit checker | |
CodeSonar | 7.1p0 | ALLOC.LEAK | Leak |
Coverity | 2017.07 | ALLOC_FREE_MISMATCH | Partially implemented, correct implementation is more involved |
Helix QAC | 2022.2 | C1780, C1781, C1782, C1783, C1784 | |
Parasoft C/C++test | 2022.1 | CERT_C-CON30-a | Ensure resources are freed |
Polyspace Bug Finder | R2022a | CERT C: Rule CON30-C | Checks for thread-specific memory leak (rule fully covered) |
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
CON34-C | Medium | Probable | High | P4 | L3 |
Tool | Version | Checker | Description |
---|---|---|---|
CodeSonar | 7.1p0 | CONCURRENCY.LOCALARG | Local Variable Passed to Thread |
Helix QAC | 2022.2 | C4926, C4927, C4928 | |
Parasoft C/C++test | 2022.1 | CERT_C-CON34-a | Declare objects shared between POSIX threads with appropriate storage durations |
Polyspace Bug Finder | R2022a | CERT C: Rule CON34-C | Checks for automatic or thread local variable escaping from a C11 thread (rule fully covered) |
PRQA QA-C | 9.7 | 4926, 4927, 4928 | Enforced by QAC |
Taxonomy | Taxonomy item | Relationship |
---|---|---|
CERT C Secure Coding Standard | DCL30-C. Declare objects with appropriate storage durations | Prior to 2018-01-12: CERT: Unspecified Relationship |
\[ ISO/IEC 9899:2011 \] | 6.2.4, "Storage Durations of Objects" |
\[ OpenMP \] | ® The OpenMP API Specification for Parallel Programming |
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
CON34-C | Medium | Probable | High | P4 | L3 |
Tool | Version | Checker | Description |
---|---|---|---|
CodeSonar | 7.1p0 | CONCURRENCY.LOCALARG | Local Variable Passed to Thread |
Helix QAC | 2022.2 | C4926, C4927, C4928 | |
Parasoft C/C++test | 2022.1 | CERT_C-CON34-a | Declare objects shared between POSIX threads with appropriate storage durations |
Polyspace Bug Finder | R2022a | CERT C: Rule CON34-C | Checks for automatic or thread local variable escaping from a C11 thread (rule fully covered) |
PRQA QA-C | 9.7 | 4926, 4927, 4928 | Enforced by QAC |
Taxonomy | Taxonomy item | Relationship |
---|---|---|
CERT C Secure Coding Standard | DCL30-C. Declare objects with appropriate storage durations | Prior to 2018-01-12: CERT: Unspecified Relationship |
\[ ISO/IEC 9899:2011 \] | 6.2.4, "Storage Durations of Objects" |
\[ OpenMP \] | ® The OpenMP API Specification for Parallel Programming |