SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 51

changes.mady.by.user Carol J. Lallier

Saved on

compared with

New Version 52

changes.mady.by.user Jill Britton

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Tool

Version

Checker

Description

LDRA tool suite

Include Page
LDRA_V
LDRA_V

434 S

Fully implemented.

Fortify SCA

V. 5.0

 

Can detect violations of this rule with CERT C Rule Pack.

Compass/ROSE

  

Can detect violations of this rule when checking for violations of INT07-C. Use only explicitly signed or unsigned char type for numeric values.

GCC

2.95 and later

-Wchar-subscripts

Detects objects of type char used as array indices.

ECLAIR

Include Page
ECLAIR_V
ECLAIR_V

charcast

Fully implemented.
PRQA QA·C
Include Page
PRQA_V
PRQA_V
 Fully implemented

Related Vulnerabilities

CVE-2009-0887 results from a violation of this rule. In Linux PAM (up to version 1.0.3), the libpam implementation of strtok casts a (potentially signed) character to an integer, for use as an index to an array. An attacker can exploit this by inputting a string with non-ASCII characters, causing the cast to result in a negative index and accessing memory outside of the array [xorl 2009].

...