The vulnerability as documented in ISO/IEC 24772-1:2024, 6.55 and ISO/IEC 24772-1 4.7.2.
In the following example, the value of size and the length of data can differ since the extent of data must be calculated at compile time but the calculation of size can be determined either at compile time or during program execution, one source of unspecified behaviour.
char data[1 + int(1 + 0.2 - 0.1 - 0.1)] = { }; // compile-time evaluation
int size = 1 + int(1 + 0.2 - 0.1 - 0.1); // compile-time or run-time evaluation
char f() { return data[size-1];} // Possible buffer overflowSimilarly, the order of evaluation of parameters in functions calls is unspecified, for example:
int i = 0;
f(i, ++i); // can be f(0,1), or f(1,1), depending on evaluation order.To avoid the vulnerability or mitigate its ill effects, C++ software developers can:
Apply the avoidance mechanisms of ISO/IEC 24772-1:2024, 6.55.5.
Use static analysis tools and multiple compilers/tools from different sources to help identify occurrences of unspecified behaviour.