...
Rule | Severity | Likelihood | Detectable | Repairable | Priority | Level |
|---|---|---|---|---|---|---|
ARR36-C | Medium | Probable | No | No | P4 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| pointer-subtraction | Partially checked | ||||||
| Axivion Bauhaus Suite |
| CertC-ARR36 | Can detect operations on pointers that are unrelated | ||||||
| CodeSonar |
| LANG.STRUCT.CUP LANG.STRUCT.SUP | Comparison of Unrelated Pointers Subtraction of Unrelated Pointers | ||||||
| Coverity |
| MISRA C 2004 17.2 MISRA C 2004 17.3 MISRA C 2012 18.2 MISRA C 2012 18.3 | Implemented | ||||||
| Cppcheck |
| comparePointers | |||||||
| Cppcheck Premium |
| comparePointers | |||||||
| Helix QAC |
| C0487, C0513 DF2668, DF2669, DF2761, DF2762, DF2763, DF2766, DF2767, DF2768, DF2771, DF2772, DF2773 | |||||||
| Klocwork |
| MISRA.PTR.ARITH | |||||||
| LDRA tool suite |
| 437 S, 438 S | Fully implemented | ||||||
| Parasoft C/C++test |
| CERT_C-ARR36-a CERT_C-ARR36-b | Do not subtract two pointers that do not address elements of the same array | ||||||
| Checks for subtraction or comparison between pointers to different arrays (rule partially covered) | ||||||||
| PVS-Studio |
| V736, V782 | |||||||
| RuleChecker |
| pointer-subtraction | Partially checked | ||||||
| Security Reviewer - Static Reviewer | 6.02 | C24 C107 | Fully Implemented | ||||||
| TrustInSoft Analyzer |
| differing_blocks | Exhaustively verified (see the compliant and the non-compliant example). |
...
ARR36-C = Union(CWE-469, list) where list =
- Pointer comparisons using the relational operators
<,<=,>=, and>, where the pointers do not refer to the same array
Bibliography
| [Banahan 2003] | Section 5.3, "Pointers" Section 5.7, "Expressions Involving Pointers" |
| [ISO/IEC 9899:2024] | 6.5.7, "Additive Operators" |
...