The PORTING checkers identify code that might rely on specific implementation details in different compilers. The PORTING.CMPSPEC.TYPE.LONGLONG checker detects the use of 'long long'.

Vulnerability and risk

This data type is very poorly defined in terms of consistency across compilers, and should be avoided where possible. Most compilers provide an abstract data model that can be used instead of this data type, so that programmers know that exactly 64 bits (for example) are going to be used, and not unexpectedly 128.

Mitigation and prevention

Use a compiler intrinsic or defined macro to represent the actual bit size you want, rather than just assuming that 'long long' has a reasonable width.

Vulnerable code example


1   void foo()
2   {
3     long long ll = 0xff00;        // PORTING.CMPSPEC.TYPE.LONGLONG
4   }

Using this type, there is no guarantee of how different compilers will reserve space on the stack for 'll'.

Fixed code example


1   void foo()
2   {
3     UINT64_t l;     // compiler-defined, or data model-provided abstract type of a defined bit width

4       l = 0xff00;
5   }

With the fixed code, you know exactly how the compiler will reserve space for 'l'. As you move between compilers, you can find a similar typedef or #define type to use for the new platform.