Page History

ALLOC.SIZE.ADDOFLOW

ALLOC.SIZE.IOFLOW

ALLOC.SIZE.MULOFLOW

ALLOC.SIZE.SUBUFLOW

ALLOC.SIZE.TRUNC

IO.TAINT.SIZE

MISC.MEM.SIZE.BAD

Addition Overflow of Allocation Size

Addition Overflow of Allocation Size

Multiplication Overflow of Allocation Size

Subtraction Underflow of Allocation Size

Truncation of Allocation Size

Tainted Allocation Size

Unreasonable Size Argument

Compass/ROSE

could check violations of this rule by examining the size expression to malloc() or memcpy() functions. Specifically, the size argument should be bounded by 0, SIZE_MAX, and, unless it is a variable of type size_t or rsize_t, it should be bounds-checked before the malloc() call. If the argument is of the expression a*b, then an appropriate check is

if (a < SIZE_MAX / b && a > 0) ...

Coverity

BAD_ALLOC_STRLEN

SIZECHECK

Can find instances where string length is miscalculated (length calculated may be one less than intended) for memory allocation purposes. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary

Finds memory allocations that are assigned to a pointer that reference objects larger than the allocated block

Fortify SCA

5.0

Can detect violations of this rule with CERT C Rule Pack, except those involving the sizeof operator

Klocwork

INCORRECT.ALLOC_SIZE

LDRA tool suite

487 S
577 S 

Fully implemented
Fully implemented 

Splint