Skip to main content

IAR Embedded Workbench for Arm 9.70.x

CERT-ARR30-C_g

In this section:
Synopsis

Do not form or use out-of-bounds pointers or array subscripts.

Enabled by default

Yes

Severity/Certainty

High/High

highhigh.png
Full description

Invalid pointer operations could lead to undefined behavior. These include forming an out-of-bounds pointer or array index, dereferencing a past-the-end pointer or array index, accessing or generating a pointer past flexible array member, and null pointer arithmetic.

Coding standards
CERT ARR30-C

Do not form or use out of bounds pointers or array subscripts

CWE 119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE 120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE 121

Stack-based Buffer Overflow

CWE 123

Write-what-where Condition

CWE 124

Buffer Underwrite ('Buffer Underflow')

CWE 126

Buffer Over-read

CWE 127

Buffer Under-read

CWE 129

Improper Validation of Array Index

CWE 786

Access of Memory Location Before Start of Buffer

Code examples

The following code example fails the check and will give a warning:

enum { TABLESIZE = 100 };

static int table[TABLESIZE];

int *f(int index) {
    if (index < TABLESIZE) {
        return table + index;
    }
    return NULL;
}

The following code example passes the check and will not give a warning about this issue:

enum { TABLESIZE = 100 };

static int table[TABLESIZE];

int *f(int index) {
    if (index >= 0 && index < TABLESIZE) {
        return table + index;
    }
    return NULL;
}