...
Incorrectly assuming that the result of the remainder operator for signed operands will always be positive can lead to an out-of-bounds memory accessor other flawed logic.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
INT10-C | High | Unlikely | High | P3 | L3 |
Automated Detection
Tool | Version | Checker | Description |
|---|---|---|---|
| Compass/ROSE |
Could detect the specific noncompliant code example. It could identify when the result of a % operation might be negative and flag usage of that result in an array index. It could conceivably flag usage of any such result without first checking that the result is positive, but it would likely introduce many false positives | |||||||||
| LDRA tool suite |
| 584 S | Fully implemented | ||||||
| Parasoft C/C++test |
|
|
| BD-PB-ARRAY | Partially implemented | |||||||
| Polyspace Bug Finder | R2016a | Tainted modulo operand | Remainder | ||||||
| PRQA QA-C |
| 3103 | Fully implemented |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Bibliography
| [Beebe 2005] |
| [ISO/IEC 9899:2011] | Subclause 6.5.5, "Multiplicative Operators" |
| [Microsoft 2007] | C Multiplicative Operators |
| [Sun 2005] | Appendix E, "Implementation-Defined ISO/IEC C90 Behavior" |
...
...