Main Content

CERT C: Rule EXP40-C

Do not modify constant objects

expand all in page

Description

Rule Definition

Do not modify constant objects.1

Polyspace Implementation

The rule checker checks for Writing to const qualified object.

Examples

expand all

Issue

Writing to const qualified object occurs when you do one of the following:

  • Use a const-qualified object as the destination of an assignment.

  • Pass a const-qualified object to a function that modifies the argument.

For instance, the defect can occur in the following situations:

  • You pass a const-qualified object as first argument of one of the following functions:

    • mkstemp

    • mkostemp

    • mkostemps

    • mkdtemp

  • You pass a const-qualified object as the destination argument of one of the following functions:

    • strcpy

    • strncpy

    • strcat

    • memset

  • You perform a write operation on a const-qualified object.

Risk

The risk depends upon the modifications made to the const-qualified object.

SituationRisk
Passing to mkstemp, mkostemp, mkostemps, mkdtemp, and so on.These functions replace the last six characters of their first argument with a string. Therefore, they expect a modifiable char array as their first argument.
Passing to strcpy, strncpy, strcat, memset and so on.These functions modify their destination argument. Therefore, they expect a modifiable char array as their destination argument.
Writing to the objectThe const qualifier implies an agreement that the value of the object will not be modified. By writing to a const-qualified object, you break the agreement. The result of the operation is undefined.
Fix

The fix depends on the modification made to the const-qualified object.

SituationFix
Passing to mkstemp, mkostemp, mkostemps, mkdtemp, and so on.Pass a non-const object as first argument of the function.
Passing to strcpy, strncpy, strcat, memset and so on.Pass a non-const object as destination argument of the function.
Writing to the objectPerform the write operation on a non-const object.

See examples of fixes below.

If you do not want to fix the issue, add comments to your result or code to avoid another review. See:

Example - Writing to const-Qualified Object
#include <string.h>

const char* buffer = "abcdeXXXXXXX";

void func(char* string) {
    char *ptr = (char*)strchr(buffer,'X');
    if(ptr)
        strcpy(ptr,string); //Noncompliant
}

In this example, because buffer is const-qualified, strchr(buffer,'X') returns a const-qualified char* pointer. When this char* pointer is used as the destination argument of strcpy, a Writing to const qualified object error appears.

Correction — Copy const-Qualified Object to Non-const Object

One possible correction is to assign the constant string to a non-const object and use the non-const object as destination argument of strchr.

#include <string.h>

char buffer[] = "abcdeXXXXXXX";

void func(char* string) { 
    char *ptr = (char*)strchr(buffer,'X');
    if(ptr)
        strcpy(ptr,string);
}

Check Information

Group: Rule 03. Expressions (EXP)

Version History

Introduced in R2019a

See Also

Topics

External Websites

1 This software has been created by MathWorks incorporating portions of: the “SEI CERT-C Website,” © 2017 Carnegie Mellon University, the SEI CERT-C++ Web site © 2017 Carnegie Mellon University, ”SEI CERT C Coding Standard – Rules for Developing safe, Reliable and Secure systems – 2016 Edition,” © 2016 Carnegie Mellon University, and “SEI CERT C++ Coding Standard – Rules for Developing safe, Reliable and Secure systems in C++ – 2016 Edition” © 2016 Carnegie Mellon University, with special permission from its Software Engineering Institute.

ANY MATERIAL OF CARNEGIE MELLON UNIVERSITY AND/OR ITS SOFTWARE ENGINEERING INSTITUTE CONTAINED HEREIN IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.

This software and associated documentation has not been reviewed nor is it endorsed by Carnegie Mellon University or its Software Engineering Institute.