CertC-DCL03

Use a static assertion to test the value of a constant expression

Required inputs: IR

Assertions are a valuable diagnostic tool for finding and eliminating software defects that may result in vulnerabilities (see MSC11-C. Incorporate diagnostic tests using assertions). The runtime assert() macro has some limitations, however, in that it incurs a runtime overhead and because it calls abort(). Consequently, the runtime assert() macro is useful only for identifying incorrect assumptions and not for runtime error checking. As a result, runtime assertions are generally unsuitable for server programs or embedded systems.

Static assertion is a new facility in the C Standard. It takes the form

static_assert(constant-expression, string-literal);

Subclause 6.7.10 of the C Standard [ ISO/IEC 9899:2011] states:

The constant expression shall be an integer constant expression. If the value of the constant expression compares unequal to 0, the declaration has no effect. Otherwise, the constraint is violated and the implementation shall produce a diagnostic message that includes the text of the string literal, except that characters not in the basic source character set are not required to appear in the message.

It means that if constant-expression is true, nothing will happen. However, if constant-expression is false, an error message containing string-literal will be output at compile time. 

/* Passes */
static_assert(
  sizeof(int) <= sizeof(void*),
  "sizeof(int) <= sizeof(void*)"
);

/* Fails */
static_assert(
  sizeof(double) <= sizeof(int),
  "sizeof(double) <= sizeof(int)"
);

Static assertion is not available in C99.

Noncompliant Code Example

This noncompliant code uses the assert() macro to assert a property concerning a memory-mapped structure that is essential for the code to behave correctly: 

#include <assert.h>
 
struct timer {
  unsigned char MODE;
  unsigned int DATA;
  unsigned int COUNT;
};

int func(void) {
  assert(sizeof(struct timer) == sizeof(unsigned char) + sizeof(unsigned int) + sizeof(unsigned int));
}

Although the use of the runtime assertion is better than nothing, it needs to be placed in a function and executed. This means that it is usually far away from the definition of the actual structure to which it refers. The diagnostic occurs only at runtime and only if the code path containing the assertion is executed.

Compliant Solution

For assertions involving only constant expressions, a preprocessor conditional statement may be used, as in this compliant solution:

struct timer {
  unsigned char MODE;
  unsigned int DATA;
  unsigned int COUNT;
};

#if (sizeof(struct timer) != (sizeof(unsigned char) + sizeof(unsigned int) + sizeof(unsigned int)))
  #error "Structure must not have any padding"
#endif

Using #error directives allows for clear diagnostic messages. Because this approach evaluates assertions at compile time, there is no runtime penalty.

Compliant Solution

This portable compliant solution uses static_assert: 

#include <assert.h>
 
struct timer {
  unsigned char MODE;
  unsigned int DATA;
  unsigned int COUNT;
};

static_assert(sizeof(struct timer) == sizeof(unsigned char) + sizeof(unsigned int) + sizeof(unsigned int),
              "Structure must not have any padding");

Static assertions allow incorrect assumptions to be diagnosed at compile time instead of resulting in a silent malfunction or runtime error. Because the assertion is performed at compile time, no runtime cost in space or time is incurred. An assertion can be used at file or block scope, and failure results in a meaningful and informative diagnostic error message.

Other uses of static assertion are shown in STR07-C. Use the bounds-checking interfaces for string manipulation and FIO34-C. Distinguish between characters read from a file and EOF or WEOF.

Risk Assessment

Static assertion is a valuable diagnostic tool for finding and eliminating software defects that may result in vulnerabilities at compile time. The absence of static assertions, however, does not mean that code is incorrect.

Recommendation Severity Likelihood Remediation Cost Priority Level
DCL03-C Low Unlikely High P1 L3
Related Guidelines
C++ Secure Coding Standard VOID DCL03-CPP. Use a static assertion to test the value of a constant expression
 Bibliography
[ Becker 2008]
[ Eckel 2007]
[ ISO/IEC 9899:2011] Subclause 6.7.10, "Static Assertions"
[ Jones 2010]
[ Klarer 2004]
[ Saks 2005]
[ Saks 2008]
Excerpt from SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems (2016 Edition) and SEI CERT C Coding Standard [https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/recommendations/declarations-and-initialization-dcl/dcl03-c], Copyright (C) 1995-2026 Carnegie Mellon University. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key

Text

Severity

Disabled

runtime_assert_could_be_static

The condition of this runtime assert is constant – use a static assertion instead

None

False

Options

exception_for_static_asserts

exception_for_static_asserts : bool = False

Make an exception for assert(false) and assert(false && "some string").
 

macro_names

macro_names : set[bauhaus.analysis.config.MacroName] = {'assert'}

Specifies the names of the assertion macros.