CERT C: Rec. INT01-C

The issue occurs when a variable or expression that represents an object size is not declared as size_t or rsize_t. Polyspace^® identifies a variable as requiring size_t or rsize_t typing when:

Pointer arithmetic is not considered.

Once a variable is identified, the checker reports a violation when the identified variable is:

The type size_t covers the entire address space and is guaranteed sufficient precision to represent the size of any object. When a narrower type such as int or unsigned int is used instead, values exceeding that type's range overflow or truncate silently. This truncation can produce undersized allocations from functions such as malloc(), leading to buffer overflows. The type rsize_t provides the additional benefit of explicit bounds checking against RSIZE_MAX, limiting values to the maximum size of a single object.

Declare variables used as array indices or object sizes with type rsize_t or size_t. When interfacing with APIs that require a different integer type, use an explicit cast rather than relying on implicit conversion.

In this example, Polyspace detects that the loop variable i is declared as int but used as an array index where size_t is appropriate.

#include <stdlib.h>
#include <stddef.h>

char *copy_string(size_t n, const char *src) {
    int i;  // Noncompliant
    char *dest = (char *)malloc(n);
    if (dest == NULL) {
        return NULL;
    }
    for (i = 0; i < n; ++i) {
        dest[i] = src[i];
    }
    return dest;
}

The variable i is used to index into arrays allocated with size n of type size_t. When n exceeds INT_MAX, the int variable overflows, causing undefined behavior.

Declare the index variable as rsize_t to match the size parameter type and prevent overflow.

#include <stdlib.h>
#include <stddef.h>
#include <stdint.h>

typedef size_t rsize_t;
#define RSIZE_MAX (SIZE_MAX >> 1)

char *copy_string(rsize_t n, const char *src) {
    rsize_t i;  // Compliant
    char *dest;
    if (n == 0 || n > RSIZE_MAX) {
        return NULL;
    }
    dest = (char *)malloc(n);
    if (dest == NULL) {
        return NULL;
    }
    for (i = 0; i < n; ++i) {
        dest[i] = src[i];
    }
    return dest;
}