CERT C: Rec. MEM05-C

The issue occurs when your code contains functions that call themselves directly or indirectly.

Variables local to a function are stored in the call stack. If a function calls itself directly or indirectly several times, the available stack space can be exceeded, causing serious failure. Unless the recursion is tightly controlled, it is difficult to determine the maximum stack space required.

void foo1( void ) {     /* Non-compliant */
          /*- Indirect recursion foo1->foo2->foo1... */
    foo2();
    foo1();   /* Non-compliant - Direct recursion */
}

void foo2( void ) {/*Noncompliant*/
         /* Indirect Recursion - Foo2->foo1->foo2*/
    foo1();
}

In this example, the rule is violated because of:

Variable length array with non-positive size occurs when size of a variable-length array is zero or negative.

If the size of a variable-length array is zero or negative, unexpected behavior can occur, such as stack overflow.

When you declare a variable-length array as a local variable in a function:

You can place a test for positive value either before the function call or the array declaration in the function body.

int input(void);

void add_scalar(int n, int m) {
    int r=0;
    int arr[m][n]; //Noncompliant
    for (int i=0; i<m; i++) {
        for (int j=0; j<n; j++) {
            arr[i][j] = input();
            r += arr[i][j];
        }
    }
}

void main() {
    add_scalar(2,2);
    add_scalar(-1,2);
    add_scalar(2,0);
}

In this example, the second and third calls to add_scalar result in a negative and zero size of arr.

One possible correction is fix or remove calls that result in a nonpositive array size.

Tainted size of variable length array detects variable length arrays (VLA) whose size is from an unsecure source.

If an attacker changed the size of your VLA to an unexpected value, it can cause your program to crash or behave unexpectedly.

If the size is non-positive, the behavior of the VLA is undefined. Your program does not perform as expected.

If the size is unbounded, the VLA can cause memory exhaustion or stack overflow.

Validate your VLA size to make sure that it is positive and less than a maximum value.

#include<stdio.h>
#inclule<stdlib.h>
#define LIM 40

long squaredSum(int size) {

	int tabvla[size]; //Noncompliant
	long res = 0;
	for (int i=0 ; i<LIM-1 ; ++i) {
		tabvla[i] = i*i;
		res += tabvla[i];
	}
	return res;
}
int main(){
	int size;
	scanf("%d",&size);
	//...
	long result = squaredSum(size);
	//...
	return 0;
}

In this example, a variable length array size is based on an input argument. Because this input argument value is not checked, the size may be negative or too large.

One possible correction is to check the size variable before creating the variable length array. This example checks if the size is larger than 10 and less than 100, before creating the VLA

enum {
    SIZE10  =  10,
    SIZE100 = 100,
    SIZE128 = 128
};

int taintedvlasize(int size) {
    int res = 0;
    if (size>SIZE10 && size<SIZE100) {
        int tabvla[size]; 
        for (int i=0 ; i<SIZE10 ; ++i) {
            tabvla[i] = i*i;
            res += tabvla[i];
        }
    }
    return res;
}