parts/6.55.UnspecifiedBehaviour-BQF.md

6.55 Unspecified Behaviour [BQF]

6.55.1 Applicability of language

The vulnerability as documented in ISO/IEC 24772-1:2024, 6.55 and ISO/IEC 24772-1 4.7.2.

In the following example, the value of size and the length of data can differ since the extent of data must be calculated at compile time but the calculation of size can be determined either at compile time or during program execution, one source of unspecified behaviour.

char data[1 + int(1 + 0.2 - 0.1 - 0.1)] = { }; // compile-time evaluation
int size = 1 + int(1 + 0.2 - 0.1 - 0.1);       // compile-time or run-time evaluation
char f() { return data[size-1];} // Possible buffer overflow

Similarly, the order of evaluation of parameters in functions calls is unspecified, for example:

int i = 0;
f(i, ++i); // can be f(0,1), or f(1,1), depending on evaluation order.

6.55.2 Avoidance mechanisms for language users

To avoid the vulnerability or mitigate its ill effects, C++ software developers can: