Page History

ALLOC.SIZE.ADDOFLOW
ALLOC.SIZE.IOFLOW
ALLOC.SIZE.MULOFLOW
ALLOC.SIZE.SUBUFLOW
ALLOC.SIZE.TRUNC
IO.TAINT.SIZE
MISC.MEM.SIZE.BAD

Addition overflow of allocation size
Addition overflow of allocation size
Multiplication overflow of allocation size
Subtraction underflow of allocation size
Truncation of allocation size
Tainted allocation size
Unreasonable size argument

Compass/ROSE

Could check violations of this rule by examining the size expression to malloc() or memcpy() functions. Specifically, the size argument should be bounded by 0, SIZE_MAX, and, unless it is a variable of type size_t or rsize_t, it should be bounds-checked before the malloc() call. If the argument is of the expression a*b, then an appropriate check is

if (a < SIZE_MAX / b && a > 0) ...

Coverity

BAD_ALLOC_STRLEN

SIZECHECK

Can find instances where string length is miscalculated (length calculated may be one less than intended) for memory allocation purposes. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary

Finds memory allocations that are assigned to a pointer that reference objects larger than the allocated block

Fortify SCA

5.0

Can detect violations of this rule with CERT C Rule Pack, except those involving the sizeof operator

Klocwork

INCORRECT.ALLOC_SIZE

LDRA tool suite

Splint