CERT C: Rule MSC39-C

Do not call va_arg() on a va_list that has an indeterminate value

Description

Rule Definition

Do not call va_arg() on a va_list that has an indeterminate value.¹

Polyspace Implementation

The rule checker checks for Use of indeterminate va_list values.

Examples

Use of indeterminate va_list values

Issue

This issue occurs when:

• You use a local va_list without initializing it first using va_start or va_copy.

  You might be using the local va_list in va_arg or a vprintf-like function (function that takes variable number of arguments).

• You use a va_list (variable argument list) from a function parameter directly instead of making a copy using va_copy and using the copy.

Risk

If you use a local va_list without initializing it first, the behavior is undefined.

If you pass a va_list to another function and use it there, the va_list has indeterminate values in the original calling function. Using the va_list in the calling function following the function call can produce unexpected results.

Fix

Initialize a local va_list with va_start or va_copy before using it.

Pass a va_list by reference. In the called function, make a copy of the passed va_list and use the copy. You can then continue to access the original va_list in the calling function.

Example – Direct Use of va_list From Another Function

#include <stdarg.h>
#include <stdio.h>

int contains_zero(size_t count, va_list ap) {
	for (size_t i = 1; i < count; ++i) {
		if (va_arg(ap, double) == 0.0) {//Noncompliant
			return 1;
		}
	}
	return 0;
}

int print_reciprocals(size_t count, ...) {
	va_list ap; 
	va_start(ap, count);

	if (contains_zero(count, ap)) {
		va_end(ap);
		return 1;
	}

	for (size_t i = 0; i < count; ++i) {
		printf("%f ", 1.0 / va_arg(ap, double));
	}

	va_end(ap);
	return 0;
}

In this example, the function print_reciprocals prints out its variable arguments and uses a helper function contains_zero to check if the va_list named ap contains zero. After ap is passed to contains_zero by value, the value of ap is indeterminate. Attempts to read this indeterminate value in print_reciprocals results in unexpected behavior. Polyspace^® flags the direct of ap in th helper function.

Correction – Copy va_list Obtained from Another Function

To avoid the violation, pass the va_list by reference and make a copy of the variable in the contains_zero function. Perform further operations on the copy.

#include <stdarg.h>
#include <stdio.h>

int contains_zero(size_t count, va_list *ap) {
	va_list ap1;
	va_copy(ap1, *ap);
	for (size_t i = 1; i < count; ++i) {
		if (va_arg(ap1, double) == 0.0) {
			return 1;
		}
	}
	va_end(ap1);
	return 0;
}

int print_reciprocals(size_t count, ...) {
	int status;
	va_list ap;
	va_start(ap, count);

	if (contains_zero(count, &ap)) {
		printf("0 in arguments!\n");
		status = 1;
	} else {
		for (size_t i = 0; i < count; i++) {
			printf("%f ", 1.0 / va_arg(ap, double));
		}
		printf("\n");
		status = 0;
	}

	va_end(ap);
	return status;
}

Check Information

Group: Rule 48. Miscellaneous (MSC)

Version History

Introduced in R2019a