Recommendations
STR00-C. Represent characters using an appropriate type
STR01-C. Adopt and implement a consistent plan for managing strings
STR02-C. Sanitize data passed to complex subsystems
STR03-C. Do not inadvertently truncate a null-terminated byte string
STR04-C. Use plain char for characters in the basic character set
STR05-C. Use pointers to const when referring to string literals
STR06-C. Do not assume that strtok() leaves the parse string unchanged
STR07-C. Use TR 24731 for remediation of existing string manipulation code
STR08-C. Use managed strings for development of new string manipulation code
STR09-C. Don't assume numeric values for expressions with type plain character
Rules
STR30-C. Do not attempt to modify string literals
STR32-C. Null-terminate byte strings as required
STR33-C. Size wide character strings correctly
STR34-C. Cast characters to unsigned types before converting to larger integer sizes
STR35-C. Do not copy data from an unbounded source to a fixed-length array
STR36-C. Do not specify the bound of a character array initialized with a string literal
STR37-C. Arguments to character handling functions must be representable as an unsigned char
STR38-C. Do not use wide-char functions on narrow-char strings and vice versa
Risk Assessment Summary
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
STR00-C | medium | probable | low | P12 | L1 |
STR01-C | low | unlikely | high | P1 | L3 |
STR02-C | high | likely | medium | P18 | L1 |
STR03-C | medium | probable | medium | P8 | L2 |
STR04-C | low | unlikely | low | P3 | L3 |
STR05-C | low | unlikely | low | P3 | L3 |
STR06-C | medium | likely | medium | P12 | L1 |
STR07-C | high | probable | medium | P12 | L1 |
STR08-C | high | probable | high | P6 | L2 |
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
STR30-C | low | likely | low | P9 | L2 |
STR31-C | high | likely | medium | P18 | L1 |
STR32-C | high | probable | medium | P12 | L1 |
STR33-C | high | likely | medium | P18 | L1 |
STR34-C | medium | probable | medium | P8 | L2 |
STR35-C | high | likely | medium | P18 | L1 |
STR36-C | high | probable | low | P18 | L1 |
STR37-C | low | unlikely | low | P3 | L3 |
STR38-C | high | likely | medium | P27 | L1 |
Related Rules and Recommendations
| Navigation Map | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
ARR38-C. Do not add or subtract an integer to a pointer if the resulting value does not refer to a valid array element CERT C Secure Coding Standard