Page History

...

This compliant solution defines the acceptable range for length as [1, MAX_TABLE_LENGTH]. The length parameter is declared as size_t, which is unsigned by definition. Consequently, it is not necessary to check length for negative values (see INT01-C. Use rsizesize_t or sizersize_t for all integer values representing the size of an object).

enum { MAX_TABLE_LENGTH = 256 };

char** create_table(void) {
  const char* const lenstr = getenv("TABLE_SIZE");
  const size_t length = lenstr ? strtoul(lenstr, NULL, 10) : 0;

  if (length == 0 || length > MAX_TABLE_LENGTH)
    return NULL;   /* Indicate error to caller */

  const size_t table_size = length * sizeof(char *);
  char** const table = (char **)malloc(table_size);

  if (table == NULL)
    return NULL;   /* Indicate error to caller */

  /* Initialize table... */
  return table;
}

...

Automated Detection

DF2794, DF2804, DF2854, DF2859, DF2864, DF2894, DF2899, DF2904, DF2909, DF2914, DF2924, DF2944, DF2949, DF2954, DF2956, DF2959

CERT_C-INT04-a
CERT_C-INT04-b
CERT_C-INT04-c

Avoid potential integer overflow/underflow on tainted data
Avoid buffer read overflow from tainted data
Avoid buffer write overflow from tainted data

CERT C: Rec. INT04-C

Checks for:

• Array access with tainted index

• Loop bounded with tainted value
• Memory allocation with tainted size
• Tainted size of variable length array

Loop controlled by a value from an unsecure source

Size argument to memory function is from an unsecure source

Rec. partially supported.