C and C++


LANG.TYPE.SAP : sizeof Array Parameter

Summary

The operand to sizeof() is a function parameter that is declared as an array.

A function parameter declared as an array of type T degenerates to a pointer to T. The result of applying sizeof() to such a parameter is therefore the size of the pointer, rather than the size of the entire array.

Properties

Class Name sizeof Array Parameter
Significance reliability
Mnemonic LANG.TYPE.SAP
Categories
MisraC2023 MisraC2023:12.5 The sizeof operator shall not have an operand which is a function parameter declared as "array of type"
Misra2012 Misra2012:12.5 The sizeof operator shall not have an operand which is a function parameter declared as "array of type"
CWE CWE:467 Use of sizeof() on a Pointer Type
TS17961 TS17961:5.37-sizeofptr 5.37. Taking the size of a pointer to determine the size of the pointed-to type
CERT-C CERT-C:ARR01-C Do not apply the sizeof operator to a pointer when taking the size of an array
Availability Available for C and C++.
Enabling Checks for this warning class are disabled by default, and require the unnormalized C ASTs for the project. To enable them, add the following WARNING_FILTER rule and RETAIN_UNNORMALIZED_C_AST specification to the project configuration file.
RETAIN_UNNORMALIZED_C_AST = Yes
WARNING_FILTER += allow class="sizeof Array Parameter"
Note that retaining the unnormalized ASTs will increase the disk space used to store the project representation, and may make the analysis take longer.

Example

int global_array[] = {1, 2, 3};

int lang_type_sap(int a[5], int b){
    int rv = 0;
    int local_array[] = {6, 7, 8};

    rv += sizeof(a);           /* 'sizeof Array Parameter' warning issued here
                                * - because of array parameter degeneration,
                                *   sizeof(a) == sizeof(int*)
                                *   (not 5*sizeof(int)).
                                */
    rv += sizeof(global_array);            /* ok: global_array is a global,
                                            * not a parameter of lang_type_sap(),
                                            * so this is the size of the entire array.
                                            */
    rv += sizeof(local_array);             /* ok: local_array is a local,
                                            * not a parameter of lang_type_sap(),
                                            * so this is the size of the entire array.
                                            */
    rv += sizeof(b);                       /* ok: b is a parameter of lang_type_sap()
                                            * but is not declared as an array of type.
                                            */
    return rv;
}

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.