CERT C++: DCL55-CPP

Information leakage due to structure padding occurs when sending a pointer to a data structure across a trust boundary without first initializing any padding bits in the data structure.

Class objects can contain padding bits. Because padding bits are defined by implementation, the layout of a class object can be unique between different compilers and architectures. Padding bits can be present at any location within a class object instance.

Sensitive information such as personal data, passwords, or pointers to kernel data structures can remain within the padding bits if the data is not properly initialized. If a class object is sent across a trust barrier, the sensitive data stored within padding bits can be exposed.

Verify that no sensitive data is contained within the padding bits before sending a class object instance across a trust boundary. Explicitly declare padding bits as fields within the class object or serialize the data before external use.

In this example, the structure test contains padding bits in order to properly align class data members. These padding bits may contain sensitive data which could be leaked when the data is copied to user space.

#include <cstddef> 

struct example {
	int car;
	char model;
	int vin;
};

extern int send_to_external(void* dest, void* src, std::size_t size);

void processData(void* user_buffer) {
	example test{};
	test.car = 1;
	test.model = 2;
	test.vin = 3;

	send_to_external(user_buffer, &test, sizeof(test));//Noncompliant
} 

Serialize the data structure before you copy it to an untrusted context so no padding bits contain sensitive data.

#include <cstddef>
#include <cstring> 

struct example {
	int car;
	char model;
	int vin;
};

extern int send_to_external(void* dest, void* src, std::size_t size);

void processData(void* user_buffer) {
	example test{ 1, 2, 3 };

	unsigned char buff[sizeof(test)];
	std::size_t offset = 0;

	std::memcpy(buff + offset, &test.car, sizeof(test.car));
	offset += sizeof(test.car);
	std::memcpy(buff + offset, &test.model, sizeof(test.model));
	offset += sizeof(test.model);
	std::memcpy(buff + offset, &test.vin, sizeof(test.vin));
	offset += sizeof(test.vin);

	send_to_external(user_buffer, buff, offset /* size of info copied */);
}