SEI CERT C Coding Standard

Declarations and Initialization (DCL) - DCL39-C. Avoid information leakage when passing a structure across a trust boundary
struct test {
int a;
char b;
int c;
};
#pragma pack(pop)
/* Safely copy bytes to user space */
extern int copy_to_user(void *dest, void *src, size_t size);
void do_stuff(void *usr_buf) {
struct test arg = {1, 2, 3};
copy_to_user(usr_buf, &arg, sizeof(arg));
}
The pack pragma takes effect at the first struct declaration after the pragma is seen.
3.6.7 Noncompliant Code Example
This noncompliant code example also runs in kernel space and copies data from struct test to
user space. However, padding bits will be used within the structure due to the bit-field member
lengths not adding up to the number of bits in an unsigned object. Further, there is an unnamed
bit-field that causes no further bit-fields to be packed into the same storage unit. These padding
bits may contain sensitive information, which may then be leaked when the data is copied to user
space. For instance, the uninitialized bits may contain a sensitive kernel space pointer value that
can be trivially reconstructed by an attacker in user space.
#include
struct test {
unsigned a : 1;
unsigned : 0;
unsigned b : 4;
};
/* Safely copy bytes to user space */
extern int copy_to_user(void *dest, void *src, size_t size);
void do_stuff(void *usr_buf) {
struct test arg = { .a = 1, .b = 10 };
copy_to_user(usr_buf, &arg, sizeof(arg));
}
However, compilers are free to implement the initialization of arg.a and arg.b by setting the
low byte of a 32-bit register to the value specified, leaving the high bytes unchanged and storing
all 32 bits of the register into memory. This implementation could leak the high-order bytes resident
in the register to a user.
SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems 57
Software Engineering Institute | Carnegie Mellon University
[DISTRIBUTION STATEMENT A] Approved for public release and unlimited distribution.