...
Replacing secure functions with less secure functions is a very risky practice because developers can be easily fooled into trusting the function to perform a security check that is absent. This may be a concern, for example, as developers attempt to adopt more secure functions , such as the C11 Annex K functions, that might not be available on all platforms. (See VOID STR07-C. Use the bounds-checking interfaces for string manipulation.)
Recommendation | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
PRE09-C | High | Likely | Yes | MediumNo | P18 | L1 |
Automated Detection
| Tool | Version | Checker | Description | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| Supported, but no explicit checker | |||||||||||||||
| Axivion Bauhaus Suite |
| CertC-PRE09 | |||||||||||||||
| Cppcheck Premium |
| premium-cert-pre09-c | |||||||||||||||
| Helix QAC |
| C5003 | |||||||||||||||
| Polyspace Bug Finder |
| Checks for | use :
| (rec
Rec. fully covered | )PRQA QA-C | ||||||||||||
| Include Page | PRQA QA-C_v | PRQA QA-C_v | 5003 | Fully implemented. |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...