CERT C: Rec. INT00-C

The issue occurs when you use basic numerical types instead of typedefs that indicate size and signedness.

The rule checker flags use of basic data types in variable or function declarations and definitions. The rule enforces use of typedefs instead.

The rule checker does not flag the use of basic types in the typedef statements themselves.

When the amount of memory being allocated is important, using specific-length types makes it clear how much storage is being reserved for each object.

typedef unsigned int uint32_t;

int x = 0;       /* Non compliant */
uint32_t y = 0;  /* Compliant */

In this example, the declaration of x is noncompliant because it uses a basic type directly.

Integer overflow occurs when an operation on integer variables can result in values that cannot be represented by the result data type. The data type of a variable determines the number of bytes allocated for the variable storage and constrains the range of allowed values.

The exact storage allocation for different floating point types depends on your processor. See Target processor type (-target).

Integer overflows on signed integers result in undefined behavior.

The fix depends on the root cause of the defect. Often the result details show a sequence of events that led to the defect. Use this event list to determine how the variables in the overflowing computation acquire their current values. You can implement the fix on any event in the sequence. If the result details do not show the event history, you can trace back using right-click options in the source code and see previous related events. See also Interpret Bug Finder Results in Polyspace Desktop User Interface.

You can fix the defect by:

To avoid overflows in general, try one of these techniques:

See examples of fixes below.

If you do not want to fix the issue, add comments to your result or code to avoid another review. See:

#include <limits.h>
typedef int int32;
int32 plusplus(void) {

    int32 var = INT_MAX;
    var++;   //Noncompliant           //Noncompliant
    return var;
}

In the third statement of this function, the variable var is increased by one. But the value of var is the maximum integer value, so an int cannot represent one plus the maximum integer value.

One possible correction is to change data types. Store the result of the operation in a larger data type (Note that on a 32-bit machine, int and long has the same size). In this example, on a 32-bit machine, by returning a long long instead of an int, the overflow error is fixed.

#include <limits.h>
typedef int int32;
typedef long long llint; 
llint plusplus(void) {

    llint var = INT_MAX;
    var++;   //Compliant          
    return var;
}

Integer constant overflow occurs when you assign a compile-time constant to a signed integer variable whose data type cannot accommodate the value. An n-bit signed integer holds values in the range [-2n-1, 2n-1-1].

For instance, c is an 8-bit signed char variable that cannot hold the value 255.

signed char c = 255;

To determine the sizes of fundamental types, Bug Finder uses your specification for Target processor type (-target).

The default behavior for constant overflows can vary between compilers and platforms. Retaining constant overflows can reduce the portability of your code.

Even if your compilers wraps around overflowing constants with a warning, the wrap-around behavior can be unintended and cause unexpected results.

Check if the constant value is what you intended. If the value is correct, use a different, possibly wider, data type for the variable.

#define MAX_UNSIGNED_CHAR 255  //Noncompliant
#define MAX_SIGNED_CHAR 127 //Noncompliant

void main() {
    char c1 = MAX_UNSIGNED_CHAR;
    char c2 = MAX_SIGNED_CHAR+1;
}

In this example, the defect appears on the macros because at least one use of the macro causes an overflow. To reproduce these defects, use a Target processor type (-target) where char is signed by default.

One possible correction is to use a different data type for the variables that overflow.

#define MAX_UNSIGNED_CHAR 255 
#define MAX_SIGNED_CHAR 127
typedef unsigned char uchar;
void main() {
    uchar c1 = MAX_UNSIGNED_CHAR;
    uchar c2 = MAX_SIGNED_CHAR+1;
}

Format string specifiers and arguments mismatch occurs when the format specifiers in the formatted output functions such as printf do not match their corresponding arguments. For example, an argument of type unsigned long must have a format specification of %lu.

Mismatch between format specifiers and the corresponding arguments result in undefined behavior.

Make sure that the format specifiers match the corresponding arguments. For instance, in this example, the %d specifier does not match the string argument message and the %s specifier does not match the integer argument err_number.

  const char *message = "License not available";
  int err_number = ;-4
  printf("Error: %d (error type %s)\n", message, err_number);

If you do not want to fix the issue, add comments to your result or code to avoid another review. See:

#include <stdio.h>
typedef unsigned long UL;
void string_format(void) {

    UL fst = 1;

    printf("%d\n", fst); //Noncompliant //Noncompliant
}

In the printf statement, the format specifier, %d, does not match the data type of fst.

One possible correction is to use the %lu format specifier. This specifier matches the unsigned integer type and long size of fst.

#include <stdio.h>
typedef unsigned long UL;
typedef int int32;
void string_format(void) {

    UL fst = 1;

    printf("%lu\n", fst); //Compliant
}

One possible correction is to change the argument to match the format specifier. Convert fst to an integer to match the format specifier and print the value 1.

#include <stdio.h>
typedef unsigned long UL;
typedef int int32;
void string_format(void) {

    UL fst = 1;

    printf("%d\n", (int32)fst); //Compliant
}