Struct member declared with no size or a zero-size array
ID |
c.maintainability.flexible_array_member |
Severity |
low |
Remediation Complexity |
hard |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Memory Layout |
Language |
C / C++ |
Description
This member has no declared size (or a zero-size array), which C99 recognizes as a flexible array member: the struct must be allocated dynamically with room for the trailing data, and sizeof on the struct excludes it entirely. Copying, comparing or sizeof-ing the struct as an ordinary value silently drops or corrupts the trailing data. Confirm this member is the struct’s last field, that instances are always heap-allocated with the extra room accounted for, and document the invariant at the declaration.
Rationale
This member has no declared size (or a zero-size array), which C99 recognizes as a flexible array member: the struct must be allocated dynamically with room for the trailing data, and sizeof on the struct excludes it entirely. Copying, comparing or sizeof-ing the struct as an ordinary value silently drops or corrupts the trailing data. Confirm this member is the struct’s last field, that instances are always heap-allocated with the extra room accounted for, and document the invariant at the declaration.
The following code illustrates the pattern detected by this rule:
struct packet {
int len;
// FLAGGED: Struct member declared with no size or a zero-size array
char data[];
};Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.