CERT C: Rec. API05-C

Use conformant array parameters

Since R2026a

Description

Use conformant array parameters¹

Polyspace Implementation

The rule checker checks for Unspecified array size in function signature.

Examples

Unspecified array size in function signature

Issue

This issue occurs when either of these conditions is true:

• A function accepts a pointer and a size_t argument. This pattern indicates that the pointer may point to an array that has the size specified by the size_t parameter. But the relationship between the pointer and the size_t parameter is not explicit in the function signature.

• A function accepts an array parameter that does not specify its size.

The checker reports the violation on the function signature in the function definition. The result details for the violation contain events that list one or more function parameters that cause the violation.

Risk

If the size of an array argument is not explicitly specified, then you can invoke the function with an unexpected array size, resulting in runtime array overflow. Specifying the size of an array parameter in the function signature documents the size of the expected array, resulting in code that is easier to read and maintain.

Fix

To fix this issue, avoid passing arrays to function as pointers. Instead, pass arrays to functions using array notation with the array size explicitly specified in the function signature:

void foo(size_t n, int arr[n]);

Example

In this example, the function sum() accepts a pointer and a size_t argument. Polyspace^® reports a violation.

#include <stdio.h>

int sum(int *input, size_t n){ //Noncompliant
    int result = 0;
    for(int i = 0; i < n; ++i){
        result += *(input + i);
    }
    return result;
}

int main()
{
    int array[] = {1,2,3,4};
    printf("%d", sum(array, 4));

    return 0;
}

Correction

To fix this violation, modify the signature of sum() so that it accepts an array of specific length:

#include <stdio.h>

int sum(size_t n, int input[n]){ //Compliant
    int result = 0;
    for(int i = 0; i < n ;++i){
        result += *(input + i);
    }
    return result;
}

int main()
{
    int array[] = {1,2,3,4};
    printf("%d", sum(4, array));

    return 0;
}

Check Information

Group: Rec. 13. Application Programming Interfaces (API)

PQL Name: std.cert.API05_C

Version History

Introduced in R2026a