...
This compliant solution replaces the hard-coded value 4 with sizeof(int *).:
| Code Block | ||||
|---|---|---|---|---|
| ||||
size_t i;
int **matrix = (int **)calloc(100, sizeof(*matrix));
if (matrix == NULL) {
/* handle error */
}
for (i = 0; i < 100; i++) {
matrix[i] = (int *)calloc(i, sizeof(**matrix));
if (matrix[i] == NULL) {
/* handle error */
}
}
|
...
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
Compass/ROSE |
|
| Can detect violations of this recommendation. In particular, it looks for the size argument of | ||||||
| ECLAIR |
| funcalls | Can detect violations of this recommendation. In particular, it considers when the size of a type is used by malloc(), calloc() or realloc() and flags these functions if either the size argument does not use a sizeof operator, or the size argument uses sizeof, but the type of the returned value is not a pointer to the type of the argument to sizeof. It does not flag if the returned value is assigned to a char *. | ||||||
| 201 S | Partially implemented. |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| CERT C++ Secure Coding Standard | EXP09-CPP. Use sizeof to determine the size of a type or variable |
| MITRE CWE | CWE 805, Buffer access with incorrect length value |
...