CERT C: Rule DCL30-C

Declare objects with appropriate storage durations

Description

Rule Definition

Declare objects with appropriate storage durations.¹

Polyspace Implementation

The rule checker checks for Pointer or reference to stack variable leaving scope.

Examples

Pointer or reference to stack variable leaving scope

Issue

Pointer or reference to stack variable leaving scope occurs when a pointer or reference to a local variable leaves the scope of the variable. For instance:

• A function returns a pointer to a local variable.

• A function performs the assignment globPtr = &locVar. globPtr is a global pointer variable and locVar is a local variable.

• A function performs the assignment *paramPtr = &locVar. paramPtr is a function parameter that is, for instance, an int** pointer and locVar is a local int variable.

• A C++ method performs the assignment memPtr = &locVar. memPtr is a pointer data member of the class the method belongs to. locVar is a variable local to the method.

The defect also applies to memory allocated using the alloca function. The defect does not apply to static, local variables. Polyspace^® assumes that the local objects within a function definition are in the same scope.

Risk

Local variables are allocated an address on the stack. Once the scope of a local variable ends, this address is available for reuse. Using this address to access the local variable value outside the variable scope can cause unexpected behavior.

If a pointer to a local variable leaves the scope of the variable, Polyspace Bug Finder™ highlights the defect. The defect appears even if you do not use the address stored in the pointer. For maintainable code, it is a good practice to not allow the pointer to leave the variable scope. Even if you do not use the address in the pointer now, someone else using your function can use the address, causing undefined behavior.

Fix

Do not allow a pointer or reference to a local variable to leave the variable scope.

Example - Pointer to Local Variable Returned from Function

void func2(int *ptr) {
    *ptr = 0;
}

int* func1(void) {
    int ret = 0; //Noncompliant
    return &ret ;
}
void main(void) {
    int* ptr = func1() ;
    func2(ptr) ;
}

In this example, func1 returns a pointer to local variable ret.

In main, ptr points to the address of the local variable. When ptr is accessed in func2, the access is illegal because the scope of ret is limited to func1,

Check Information

Group: Rule 02. Declarations and Initialization (DCL)

Version History

Introduced in R2019a

R2022a: Checker considers that all objects local to function are in same scope

The rule checker assumes that all local objects within a function definition are in the same scope. Consider this code:

void foo(){
	int* p;
	{
		int tmp = 4;
		p = &tmp;
	}
	int q = *p;//Compliant
	
}

The checker assumes that tmp, p and q are in the same scope.