MSC08-C. Library functions should validate their parameters

Redundant testing by caller and by callee as a style of defensive programming is largely discredited within the C and C++ community, the main problem being performance. The usual discipline in C and C++ is to require validation only on one side of each interface.

When writing a library, each exposed function should perform a validity check on its parameters. Validity checks allow the library to survive at least some forms of improper usage, enabling an application using the library to likewise survive, and often simplifies the task of determining the condition that caused the invalid parameter.

Noncompliant Code Example

In this noncompliant code example, setfile() and usefile() do not validate their parameters. It is possible that an invalid file pointer may be used by the library, corrupting the library's internal state and exposing a vulnerability.

/* sets some internal state in the library */
extern int setfile(FILE *file);

/* performs some action using the file passed earlier */
extern int usefile();

static FILE *myFile;

void setfile(const FILE *file) {
    myFile = file;
}

void usefile(void) {
    /* perform some action here */
}

The vulnerability may be more severe if the internal state references sensitive or system-critical data.

Compliant Solution

Validating the function parameters and verifying the internal state leads to consistency of program execution and may eliminate potential vulnerabilities.

/* sets some internal state in the library */
extern int setfile(FILE *file);

/* performs some action using the file passed earlier */
extern int usefile();

static FILE *myFile;

errno_t setfile(FILE *file) {
 if (file && !ferror(file) && !feof(file)) {
    myFile = file;
    return 0;
  }

  myFile = NULL;
  return INVALID_ARG;
}

errno_t usefile(void) {
  if (!myFile) return -1;

    /* perform other checks if needed, return 
     * error condition */

    /* perform some action here */
    return 0;
}

Risk Assessment

Failing to validate the parameters in library functions may result in an access violation or a data integrity violation. Such a scenario is indicative of a flaw in the manner in which the library is used by the calling code. However, it may still be the library itself that is the vector by which the calling code's vulnerability is exploited.

Automated Detection

The LDRA tool suite V 7.6.0 can detect violations of this recommendation.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C++ Secure Coding Standard as MSC08-CPP. Library functions should validate their parameters.

References

[[Apple 06]] Application Interfaces That Enhance Security, May 2006.
[[MITRE 07]] CWE ID 20, "Insufficient Input Validation"

      49. Miscellaneous (MSC)      MSC09-C. Character Encoding - Use Subset of ASCII for Safety