SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 124

changes.mady.by.user Jill Britton

Saved on

compared with

New Version Current

changes.mady.by.user Francesco Mariani

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Recommendation

Severity

Likelihood

Detectable

RepairableRemediation Cost

Priority

Level

MEM05-C

Medium

Likely

No

NoMedium

P12P6

L1L2

Automated Detection

PRQA QACPRQA QACvPRQA QACvPVS-StudioPVSStudioPVSStudioV505

Tool

Version

Checker

Description

CodeSonar
Include Page
CodeSonar_V
CodeSonar_V

IO.TAINT.SIZE

MISC.MEM.SIZE.BAD

Tainted Allocation Size

Unreasonable Size Argument

Coverity

Include Page
Coverity_V
Coverity_V

STACK_USE

Can help detect single stack allocations that are dangerously large, although it will not detect excessive stack use resulting from recursion

Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C1051, C1520, C3670
Klocwork
Include Page
Klocwork_V
Klocwork_V
MISRA.FUNC.RECUR
LDRA tool suite
Include Page
LDRA_V
LDRA_V
44 SEnhanced Enforcement
Parasoft C/C++test

Include Page
Parasoft_V
Parasoft_V

CERT_C-MEM05-a
CERT_C-MEM05-b

Do not use recursion
Ensure the size of the variable length array is in valid range

PC-lint Plus

Include Page
PC-lint Plus_V
PC-lint Plus_V

9035, 9070

Partially supported: reports use of variable length arrays and recursion

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rec. MEM05-C


Checks for:

  • Direct or indirect function call to itself
  • Variable length array with nonpositive size
  • Tainted size of variable length array

Rec. partially covered.

PVS-Studio

Include Page

PVS-

Studio_

V

PVS-

Studio_

1051, 1520, 3670

Partially implemented

V

V505
Security Reviewer - Static Reviewer

Include Page

Security Reviewer -

Static Reviewer_V

Security Reviewer -

Static Reviewer_V

CPP_010Fully implemented

Related Vulnerabilities

Stack overflow has been implicated in Toyota unintended acceleration cases, where Camry and other Toyota vehicles accelerated unexpectedly.  Michael Barr testified at the trial that a stack overflow could corrupt the critical variables of the operating system, because they were located in memory adjacent to the top of the stack [Samek 2014].

...