extern array declared without a size
ID |
c.correctness.extern_array_without_size |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
medium |
Remediation Effort |
low |
Resource |
Type Safety |
Language |
C / C++ |
Description
This extern array declaration has no size, so the array has an incomplete type at every point that includes this declaration. sizeof cannot be applied to it, pointer arithmetic bounds are unknown, and if the defining translation unit gives the array a different size than the readers assume, nothing catches the mismatch. Give the declaration the same size as the definition, or declare it through a header the definition also includes so the sizes cannot drift apart.
Rationale
This extern array declaration has no size, so the array has an incomplete type at every point that includes this declaration. sizeof cannot be applied to it, pointer arithmetic bounds are unknown, and if the defining translation unit gives the array a different size than the readers assume, nothing catches the mismatch. Give the declaration the same size as the definition, or declare it through a header the definition also includes so the sizes cannot drift apart.
The following code illustrates the pattern detected by this rule:
// FLAGGED: extern array declared without a size
extern int lookup_table[];Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.