CertC++-OOP57¶

Prefer special member functions and overloaded operators to C Standard Library functions

Required inputs: IR

Several C standard library functions perform bytewise operations on objects. For instance, std::memcmp() compares the bytes comprising the object representation of two objects, and std::memcpy() copies the bytes comprising an object representation into a destination buffer. However, for some object types, it results in undefined or abnormal program behavior.

The C++ Standard, [class], paragraph 6 [ ISO/IEC 14882-2014], states the following:

A trivially copyable class is a class that:
- has no non-trivial copy constructors,
- has no non-trivial move constructors,
- has no non-trivial copy assignment operators,
- has no non-trivial move assignment operators, and
- has a trivial destructor.
A trivial class is a class that has a default constructor, has no non-trivial default constructors, and is trivially copyable. [Note: In particular, a trivially copyable or trivial class does not have virtual functions or virtual base classes. - end note]

Additionally, the C++ Standard, [class], paragraph 7, states the following:

A standard-layout class is a class that:
- has no non-static data members of type non-standard-layout class (or array of such types) or reference,
- has no virtual functions and no virtual base classes,
- has the same access control for all non-static data members,
- has no non-standard-layout base classes,
- either has no non-static data members in the most derived class and at most one base class with non-static data members, or has no base classes with non-static data members, and
- has no base classes of the same type as the first non-static data member.

Do not use std::memset() to initialize an object of nontrivial class type as it may not properly initialize the value representation of the object. Do not use std::memcpy() (or related bytewise copy functions) to initialize a copy of an object of nontrivial class type, as it may not properly initialize the value representation of the copy. Do not use std::memcmp() (or related bytewise comparison functions) to compare objects of nonstandard-layout class type, as it may not properly compare the value representations of the objects. In all cases, it is best to prefer the alternatives.

C Standard Library Function	C++ Equivalent Functionality
`std::memset()`	Class constructor
`std::memcpy()` `std::memmove()` `std::strcpy()`	Class copy constructor or `operator=()`
`std::memcmp()` `std::strcmp()`	`operator<()`, `operator>()`, `operator==()`, or `operator!=()`

Noncompliant Code Example

In this noncompliant code example, a nontrivial class object is initialized by calling its default constructor but is later reinitialized to its default state using std::memset(), which does not properly reinitialize the object. Improper reinitialization leads to class invariants not holding in later uses of the object.

#include <cstring>
#include <iostream>
 
class C {
  int scalingFactor;
  int otherData;
 
public:
  C() : scalingFactor(1) {}

  void set_other_data(int i);
  int f(int i) {
    return i / scalingFactor;
  }
  // ...
};
 
void f() {
  C c;

  // ... Code that mutates c ...

  // Reinitialize c to its default state
  std::memset(&c, 0, sizeof(C));

  std::cout << c.f(100) << std::endl;
}

The above noncompliant code example is compliant with EXP62-CPP. Do not access the bits of an object representation that are not part of the object's value representation because all of the bits in the value representation are also used in the object representation of C.

Compliant Solution

In this compliant solution, the call to std::memset() is replaced with a default-initialized copy-and-swap operation called clear(). This operation ensures that the object is initialized to its default state properly, and it behaves properly for object types that have optimized assignment operators that fail to clear all data members of the object being assigned into.

#include <iostream>
#include <utility>
 
class C {
  int scalingFactor;
  int otherData;
 
public:
  C() : scalingFactor(1) {}

  void set_other_data(int i);
  int f(int i) {
    return i / scalingFactor;
  }
  // ...
};
 
template <typename T>
T& clear(T &o) {
  using std::swap;
  T empty;
  swap(o, empty);
  return o;
}

void f() {
  C c;

  // ... Code that mutates c ...

  // Reinitialize c to its default state
  clear(c);

  std::cout << c.f(100) << std::endl;
}

Noncompliant Code Example

In this noncompliant code example, std::memcpy() is used to create a copy of an object of nontrivial type C. However, because each object instance attempts to delete the int * in C::~C(), double-free vulnerabilities may occur because the same pointer value will be copied into c2.

#include <cstring>
 
class C {
  int *i;
 
public:
  C() : i(nullptr) {}
  ~C() { delete i; }
 
  void set(int val) {
    if (i) { delete i; }
    i = new int{val};
  }
 
  // ...
};
 
void f(C &c1) {
  C c2;
  std::memcpy(&c2, &c1, sizeof(C));
}

Compliant Solution

In this compliant solution, C defines an assignment operator that is used instead of calling std::memcpy().

class C {
  int *i;

public:
  C() : i(nullptr) {}
  ~C() { delete i; }

  void set(int val) {
    if (i) { delete i; }
    i = new int{val};
  }

  C &operator=(const C &rhs) noexcept(false) {
    if (this != &rhs) {
      int *o = nullptr;
      if (rhs.i) {
        o = new int;
        *o = *rhs.i;
      }
      // Does not modify this unless allocation succeeds.
      delete i;
      i = o;
    }
    return *this;
  }

  // ...
};

void f(C &c1) {
  C c2 = c1;
}

Noncompliant Code Example

In this noncompliant code example, std::memcmp() is used to compared two objects of nonstandard-layout type. Because std::memcmp() performs a bytewise comparison of the object representations, if the implementation uses a vtable pointer as part of the object representation, it will compare vtable pointers. If the dynamic type of either c1 or c2 is a derived class of type C, the comparison may fail despite the value representation of either object.

#include <cstring>
 
class C {
  int i;

public:
  virtual void f();

  // ...
};

void f(C &c1, C &c2) {
  if (!std::memcmp(&c1, &c2, sizeof(C))) {
    // ...
  }
}

Because a vtable is not part of an object's value representation, comparing it with std::memcmp() also violates EXP62-CPP. Do not access the bits of an object representation that are not part of the object's value representation.

Compliant Solution

In this compliant solution, C defines an equality operator that is used instead of calling std::memcmp(). This solution ensures that only the value representation of the objects is considered when performing the comparison.

class C {
  int i;

public:
  virtual void f();
  
  bool operator==(const C &rhs) const {
    return rhs.i == i;
  }

  // ...
};

void f(C &c1, C &c2) {
  if (c1 == c2) {
    // ...
  }
}

Risk Assessment

Most violations of this rule will result in abnormal program behavior. However, overwriting implementation details of the object representation can lead to code execution vulnerabilities.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
OOP57-CPP	High	Probable	High	P6	L2

Related Guidelines

SEI CERT C++ Coding Standard

EXP62-CPP. Do not access the bits of an object representation that are not part of the object's value representation

Bibliography

[ ISO/IEC 14882-2014]

Subclause 3.9, "Types"
Subclause 3.10, "Lvalues and Rvalues"
Clause 9, "Classes"

Excerpt from SEI CERT C++ Coding Standard [https://cmu-sei.github.io/secure-coding-standards/sei-cert-cpp-coding-standard/rules/object-oriented-programming-oop/oop57-cpp], Copyright (C) 1995-2026 Carnegie Mellon University. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key	Text	Severity	Disabled
non_pod_bitwise_comparison	Bitwise comparison with non-standard-layout type objects.	None	False
non_pod_bitwise_write	Bitwise write to non-trivial type object ‘{}’.	None	False

Options¶

This rule shares the following common options: exclude_in_macros, exclude_messages_in_system_headers, excludes, extend_exclude_to_macro_invocations, includes, justification_checker, languages, post_processing, provider, report_at, severity
The following places define options that affect this rule: Stylechecks, Analysis-GlobalOptions

compare_functions¶

compare_functions

Type: dict[bauhaus.analysis.config.FunctionName, list[int]]

Default:
{
   'memcmp': [0, 1],
   'strcmp': [0, 1],
   'strcpy': [0, 1]
}

Bit-wise compare functions with indexes of comparable objects.

write_functions¶

write_functions

Type: dict[bauhaus.analysis.config.FunctionName, int]

Default:
{
   'memcpy': 0,
   'memmove': 0,
   'memset': 0
}

Bit-wise copy functions with index of destination argument.

Axivion Suite 7.12.0

Navigation

CertC++-OOP57¶

Noncompliant Code Example

Compliant Solution

Noncompliant Code Example

Compliant Solution

Noncompliant Code Example

Compliant Solution

Risk Assessment

Related Guidelines

Bibliography

Options¶

compare_functions¶

write_functions¶