...
Conversion of character data resulting in a value in excess of UCHAR_MAX is an often-missed error that can result in a disturbingly broad range of potentially severe vulnerabilities.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
STR34-C | Medium | Probable | Medium | P8 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| MISC.NEGCHAR | Negative Character Value | ||||||
| Compass/ROSE |
Can detect violations of this rule when checking for violations of INT07-C. Use only explicitly signed or unsigned char type for numeric values | |||||||||
| Coverity |
| MISRA C 2012 Rule 10.1 MISRA C 2012 Rule 10.2 MISRA C 2012 Rule 10.3 MISRA C 2012 Rule 10.4 | Implemented Essential type checkers | ||||||
| CC2.STR34 | Fully implemented | |||||||
| GCC | 2.95 and later | Detects objects of type | |||||||
| LDRA tool suite |
| 434 S | Partially implemented | ||||||
| Parasoft C/C++test | 10.3 | MISRA2004-10_1_b MISRA2004-10_2_a MISRA2004-11_4 | |||||||
| PRQA QA-C |
| 4413, 4414 | Fully implemented | ||||||
| PRQA QA-C++ | 4.2 | 3051 |
Related Vulnerabilities
CVE-2009-0887 results from a violation of this rule. In Linux PAM (up to version 1.0.3), the libpam implementation of strtok() casts a (potentially signed) character to an integer for use as an index to an array. An attacker can exploit this vulnerability by inputting a string with non-ASCII characters, causing the cast to result in a negative index and accessing memory outside of the array [xorl 2009].
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| CERT C Secure Coding Standard | STR37-C. Arguments to character-handling functions must be representable as an unsigned char STR04-C. Use plain char for characters in the basic character set ARR30-C. Do not form or use out-of-bounds pointers or array subscripts |
| ISO/IEC TS 17961:2013 | Conversion of signed characters to wider integer types before a check for EOF [signconv] |
| MISRA-C:2012 | Rule 10.1 (required) Rule 10.2 (required) Rule 10.3 (required) Rule 10.4 (required) |
| MITRE CWE | CWE-704, Incorrect Type Conversion or Cast |
Bibliography
...
...