CXX.ARRAY_INDEX.WITHOUT_CHECK

The use of n as an array index should only be done within an if statement that checks limits.

To avoid array buffer overruns, it is prudent to ensure that any array index expressions are encapsulated within an if statement checking the index expression is within limits.

Vulnerability and risk

Array access violations are a common source of security vulnerabilities in embedded systems in particular.

Vulnerable code example 1

1
array[n] = x;

This example includes no condition.

Vulnerable code example 2

1
2
if ( /* some condition but no mention of n */ )
    array[n + 1] = x;

This example includes a condition but with no mention of n.

1
2
if (n < i && n > j) 
  array[n] = x;