CERT C: Rec. API00-C

R2026b

Functions should validate their parameters

Since R2026b

Description

Functions should validate their parameters¹

Polyspace Implementation

Polyspace^® checks for the issue Unchecked Pointer Access.

Examples

Unchecked Pointer Access

Issue

The issue occurs when these conditions are met:

• A function reads or writes into a pointer parameter, global pointer variable, or array parameter.

• Before the pointer access, the pointer is not checked by either explicit or implicit comparison.

The checker does not report violations on local pointer variables declared within a function. The (void)param idiom for marking unused parameters is not considered a violation.

Risk

Dereferencing an invalid or null pointer causes undefined behavior, which can crash the program or corrupt memory. Functions that do not validate their parameters create fragile interfaces where callers cannot rely on graceful handling of invalid inputs.

Fix

Add a NULL check for each pointer or array parameter and global pointer variable before any dereference or assignment. Place the validity check before all other operations on the pointer.

Example — Pointer Parameter Used Without Validation

In this example, the function process() assigns from the pointer data without verifying that it is not NULL. The function increment() dereferences value without validation. Both functions violate the principle of parameter validation at API boundaries..

#include <stddef.h>

static int *result;

void process(int *data) {
    result = data;  // Noncompliant
}

void increment(int *value) {
    (*value)++;  // Noncompliant
}

Correction — Validate Pointer Before Access

Add a NULL check before the first use of the pointer parameter.

#include <stddef.h>

static int *result;

void process(int *data) {
    if (data != NULL) {  // Compliant
        result = data;
    }
}

void increment(int *value) {
    if (value != NULL) {  // Compliant
        (*value)++;
    }
}

Check Information

Group: Rec. 13. Application Programming Interfaces (API)

PQL Name: std.cert.API00_C

Version History

Introduced in R2026b