MISC.PADDING.POTB : Padding Passed Across a Trust Boundary

Summary

A reference to padded data is passed to a function that crosses a trust boundary: for example, a function that transfers information from kernel space to user space, or from memory to a file.

For this purposes of this warning class:

• A function is considered to cross a trust boundary if it is specified with a PASS_OVER_TRUST_BOUNDARY_CHECKED_FUNCS rule.
• A type T is considered to be padded if:
  • T is a class or struct,
    and
  • the size of T is greater than the sum of the sizes of its constituent fields (including nested fields).

Properties

WARNING_FILTER += discard class="Padding Passed Across a Trust Boundary"

Example

#include <unistd.h>

/* this struct requires padding before field y */
typedef struct padded_struct {
    int x;
    char c;
    int y;
} padded_struct_t;

/* compilers will not typically pad this struct */
/* (your compiler may differ) */
typedef struct unpadded_struct{
    int x;
    int y;
} unpadded_struct_t;


/* a user-defined function that does not pass data across a trust boundary */
void stay_inside_boundary(void *ptr);

int misc_padding_potb(padded_struct_t *ps, unpadded_struct_t *us, int fd){
    int a,b;

    stay_inside_boundary(ps);                      /* ok: data not passed across trust boundary */
    stay_inside_boundary(us);                      /* ok: data not passed across trust boundary */
    a = write(fd, ps, sizeof(*ps));  /* 'Padding Passed Across a Trust Boundary' warning issued here:
                                      * - factory settings include
                                          PASS_OVER_TRUST_BOUNDARY_CHECKED_FUNCS += 2, write
                                          * - ps is a reference to a padded struct, and is passed as 2nd argument to write()
                                          */
    b = write(fd, us, sizeof(*us));                /* ok: reference passed as 2nd argument is not to padded data */
    return a + b;
}

Notes

CodeSonar makes its padding determinations by modeling the behaviour of your regular compiler. If you are using multiple compilers with different padding strategies, you may find that a type that is padded by one compiler is not padded by another, and so passing references to that type can trigger warnings when you build with the first compiler but not when you build with the second.

The functions whose calls are checked for this warning class are specified with configuration parameter PASS_OVER_TRUST_BOUNDARY_CHECKED_FUNCS

• To include an additional function in the checks for this class, create a new PASS_OVER_TRUST_BOUNDARY_CHECKED_FUNCS rule to specify the function name and the parameter position to check.
• To remove a function from the checks for this class, edit the configuration file to comment out the corresponding PASS_OVER_TRUST_BOUNDARY_CHECKED_FUNCS rule.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

• REPORT_SIMILAR_WARNINGS
• WARNING_FILTER