CertC-ARR02

Explicitly specify array bounds, even if implicitly defined by an initializer

Required inputs: IR

The C Standard allows an array variable to be declared both with a bound and with an initialization literal. The initialization literal also implies an array bound in the number of elements specified.

The size implied by an initialization literal is usually specified by the number of elements,

int array[] = {1, 2, 3}; /* 3-element array */

but it is also possible to use designators to initialize array elements in a noncontiguous fashion. Subclause 6.7.9, Example 12, of the C Standard [ ISO/IEC 9899:2011] states:

Space can be "allocated" from both ends of an array by using a single designator:

int a[MAX] = {
  1, 3, 5, 7, 9, [MAX-5] = 8, 6, 4, 2, 0
};

In the above, if MAX is greater than ten, there will be some zero-valued elements in the middle; if it is less than ten, some of the values provided by the first five initializers will be overridden by the second five.

The C Standard also dictates how array initialization is handled when the number of initialization elements does not equal the explicit array bound. Subclause 6.7.9, paragraphs 21 and 22, state:

If there are fewer initializers in a brace-enclosed list than there are elements or members of an aggregate, or fewer characters in a string literal used to initialize an array of known size than there are elements in the array, the remainder of the aggregate shall be initialized implicitly the same as objects that have static storage duration.
If an array of unknown size is initialized, its size is determined by the largest indexed element with an explicit initializer. The array type is completed at the end of its initializer list.

Although compilers can compute the size of an array on the basis of its initialization list, explicitly specifying the size of the array provides a redundancy check, ensuring that the array's size is correct. It also enables compilers to emit warnings if the array's size is less than the size implied by the initialization.

Note that this recommendation does not apply (in all cases) to character arrays initialized with string literals. See STR11-C. Do not specify the bound of a character array initialized with a string literal for more information.

Noncompliant Code Example (Incorrect Size)

This noncompliant code example initializes an array of integers using an initialization with too many elements for the array:

int a[3] = {1, 2, 3, 4};

The size of the array a is 3, although the size of the initialization is 4. The last element of the initialization ( 4) is ignored. Most compilers will diagnose this error.

Implementation Details

This noncompliant code example generates a warning in GCC. Microsoft Visual Studio generates a fatal diagnostic: error C2078: too many initializers.

Noncompliant Code Example (Implicit Size)

In this example, the compiler allocates an array of four integer elements and, because an array bound is not explicitly specified by the programmer, sets the array bound to 4. However, if the initializer changes, the array bound may also change, causing unexpected results. 

int a[] = {1, 2, 3, 4};
Compliant Solution

This compliant solution explicitly specifies the array bound:

int a[4] = {1, 2, 3, 4};

Explicitly specifying the array bound, although it is implicitly defined by an initializer, allows a compiler or other static analysis tool to issue a diagnostic if these values do not agree.

Exceptions

ARR02-C-EX1: STR11-C. Do not specify the bound of a character array initialized with a string literal is a specific exception to this recommendation; it requires that the bound of a character array initialized with a string literal is unspecified.

Risk Assessment
Recommendation Severity Likelihood Remediation Cost Priority Level
ARR02-C Medium Unlikely Low P6 L2
Related Guidelines
Taxonomy Taxonomy item Relationship
CERT C CTR02-CPP. Explicitly specify array bounds, even if implicitly defined by an initializer Prior to 2018-01-12: CERT: Unspecified Relationship
CWE 2.11 CWE-665, Incorrect or incomplete initialization Prior to 2018-01-12: CERT:
MISRA C:2012 Rule 8.11 (advisory) Prior to 2018-01-12: CERT: Unspecified Relationship
MISRA C:2012 Rule 9.5 (required) Prior to 2018-01-12: CERT: Unspecified Relationship
Bibliography
[ ISO/IEC 9899:2011] Subclause 6.7.9, "Initialization"
Excerpt from SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems (2016 Edition) and SEI CERT C Coding Standard [https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/recommendations/arrays-arr/arr02-c], Copyright (C) 1995-2026 Carnegie Mellon University. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key

Text

Severity

Disabled

cafe_message

{}

None

False

unbounded_array

Array declaration with unknown size.

None

False

Options

message_predicate

message_predicate : typing.Callable[[Cafe_Message], bool] | None = None

If provided, a custom predicate to filter relevant messages. Receives the message node and should return True for messages to report.
 

only_extern

only_extern : bool = False

Whether to consider only extern declared arrays.
 

report_arrays_initialized_with_string_literals

report_arrays_initialized_with_string_literals : bool = False

Whether to report character arrays without a bound that are properly initialized using a string literal. This also applies to wide character arrays.
 

report_definitions

report_definitions : bool = True

Whether definitions of array variables should also be reported.
 

reported_messages

reported_messages : set[int] | None = {1162, 146}

If provided, only messages of these types are reported.
 

reported_severities

reported_severities : set[str] = {'error', 'remark', 'warning'}

List of severities to display.
 

use_error_number

use_error_number : bool = False

Whether the error number from the frontend should be used.
 

use_rule_severity

use_rule_severity : bool = True

Whether the rule's severity or the compiler's severity should be used.