Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
Upcast array used in pointer arithmetic¶
ID: cpp/upcast-array-pointer-arithmetic
Kind: path-problem
Security severity: 9.3
Severity: warning
Precision: high
Tags:
- correctness
- reliability
- security
- external/cwe/cwe-119
- external/cwe/cwe-843
Query suites:
- cpp-code-scanning.qls
- cpp-security-extended.qls
- cpp-security-and-quality.qls
Click to see the query in the CodeQL repository
A pointer to a derived class may be implicitly converted to a pointer to its base type when passed as an argument to a function expecting a pointer to the base type. If pointer arithmetic or an array dereference is then used, it will be performed using the size of the base type. This can lead to reading data from unexpected fields in the derived type.
Recommendation¶
Only convert pointers to single objects. If you must work with a sequence of objects that are converted to a base type, use an array of pointers rather than a pointer to an array.
Example¶
class Base {
public:
int x;
}
class Derived: public Base {
public:
int y;
};
void dereference_base(Base *b) {
b[2].x;
}
void dereference_derived(Derived *d) {
d[2].x;
}
void test () {
Derived[4] d;
dereference_base(d); // BAD: implicit conversion to Base*
dereference_derived(d); // GOOD: implicit conversion to Derived*, which will be the right size
}