SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 125

changes.mady.by.user Aaron Ballman

Saved on

compared with

New Version 126

changes.mady.by.user Carol J. Lallier

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

In this compliant solution, len is declared as a size_t, so there is no possibility of this variable having a negative value and bypassing the range check:

...

In this noncompliant code example, an array of long is allocated and assigned to p. However, sizeof(int) is used to size the allocated memory. If sizeof(long) is larger than sizeof(int), then an insufficient amount of memory is allocated.

...

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

MEM35-C

highHigh

probableProbable

highHigh

P6

L2

Automated Detection

Tool

Version

Checker

Description

Compass/ROSE

 

 

could check violations of this rule by examining the size expression to malloc() or memcpy() functions. Specifically, the size argument should be bounded by 0, SIZE_MAX, and, unless it is a variable of type size_t or rsize_t, it should be bounds-checked before the malloc() call. If the argument is of the expression a*b, then an appropriate check is:

Code Block
if (a < SIZE_MAX / b && a > 0) ...

Coverity

Include Page
Coverity_V
Coverity_V

BAD_ALLOC_STRLEN


SIZECHECK

Can find instances where string length is miscalculated (length calculated may be one less than intended) for memory allocation purposes. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary

Finds memory allocations that are assigned to a pointer that reference objects larger than the allocated block

Fortify SCA

5.0

 

Can detect violations of this rule with CERT C Rule Pack, except those involving the sizeof operator

LDRA tool suite

Include Page
LDRA_V
LDRA_V

487 S

Fully implemented

...

CVE-2009-0587 results from a violation of this rule. Before version 2.24.5, Evolution Data Server performed unchecked arithmetic operations on the length of a user-input string and used the value to allocate space for a new buffer. An attacker could thereby execute arbitrary code by inputting a long string, resulting in incorrect allocation and buffer overflow [xorl 2009].

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

CERT C Secure Coding StandardINT01-C. Use rsize_t or size_t for all integer values representing the size of an object
INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data
INT32-C. Ensure that operations on signed integers do not result in overflow
INT18-C. Evaluate integer expressions in a larger size before comparing or assigning to that size
MEM04-C. Do not perform zero-length allocations
CERT C++ Secure Coding StandardMEM35-CPP. Allocate sufficient memory for an object
ISO/IEC TR 24772:2013Buffer Boundary Violation (Buffer Overflow) [HCB]
MITRE CWECWE-190, Integer overflow (wrap or wraparound)
CWE-131, Incorrect calculation of buffer size

...