...
Other uses of static assertion are shown in VOID STR07-C. Use the bounds-checking interfaces for string manipulation and FIO34-C. Distinguish between characters read from a file and EOF or WEOF.
...
Static assertion is a valuable diagnostic tool for finding and eliminating software defects that may result in vulnerabilities at compile time. The absence of static assertions, however, does not mean that code is incorrect.
Recommendation | Severity | Likelihood | Detectable |
|---|
Repairable | Priority | Level |
|---|---|---|
DCL03-C | Low | Unlikely |
Yes | Yes |
P3 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Axivion Bauhaus Suite |
| CertC-DCL03 | |||||||
| Clang |
| misc-static-assert | Checked by clang-tidy | ||||||
| CodeSonar |
| (customization) | Users can implement a custom check that reports uses of the assert() macro | ||||||
| Compass/ROSE | Could detect violations of this rule merely by looking for calls to | ||||||||
| ECLAIR |
| CC2.DCL03 | Fully implemented | ||||||
| LDRA tool suite |
| 44 S | Fully implemented | ||||||
| Security Reviewer - Static Reviewer | 6.02 | C13 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...