Page History

...

In this noncompliant code example, snprintf() is assumed to succeed. However, if the call fails (for example, because of insufficient memory, as described in GNU libc bug 441945), the subsequent call to log_message() has undefined behavior 174 because the character buffer is uninitialized and need not be null-terminated.

...

Failing to detect error conditions can lead to unpredictable results, including abnormal program termination and denial-of-service attacks or, in some situations, could even allow an attacker to run arbitrary code.

Rule	Severity	Likelihood	Detectable	Remediation CostRepairable	Priority	Level
ERR33-C	High	Likely	Yes	MediumYes	P18P27	L1

Automated Detection

Tool

Version

Checker

Description

Astrée

Include Page

	Astrée_V
	Astrée_V

error-information-unused
error-information-unused-computed

Partially checked

Axivion Bauhaus Suite

Include Page

	Axivion Bauhaus Suite_V
	Axivion Bauhaus Suite_V

CertC-ERR33

CodeSonar

Include Page

	CodeSonar_V
	CodeSonar_V

LANG.FUNCS.IRV
LANG.ERRCODE.NOTEST
LANG.ERRCODE.NZ

Ignored return value
Missing Test of Error Code
Non-zero Error Code

Compass/ROSE

Can detect violations of this recommendation when checking for violations of EXP12-C. Do not ignore values returned by functions and EXP34-C . Do not dereference null pointers

Coverity

Include Page

	Coverity_V
	Coverity_V

MISRA C 2012 Rule 22.8

MISRA C 2012 Rule 22.9

MISRA C 2012 Rule 22.10

Implemented

Cppcheck Premium

Include Page

	Cppcheck Premium_V
	Cppcheck Premium_V

premium-cert-err33-c

Helix QAC

Include Page

	Helix QAC_V
	Helix QAC_V

C3200

C++3802, C++3803, C++3804

DF2820, DF2821, DF2822, DF2823, DF2824, DF2930, DF2931, DF2932, DF2933, DF2934

Klocwork

Include Page

	Klocwork_V
	Klocwork_V

NPD.CHECK.MUST
NPD.FUNC.MUST
SV.RVT.RETVAL_NOTTESTED

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

80 D

Partially implemented

Parasoft C/C++test

Include Page

	Parasoft_V
	Parasoft_V

CERT_C-ERR33-a
CERT_C-ERR33-d
CERT_C-ERR33-e

The value returned by a standard library function that may return an error should be used
Always check the returned value of non-void function
Provide error handling for file opening errors right next to the call to fopen

Parasoft Insure++

Runtime analysis

PC-lint Plus

Include Page