| Content by Label | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
| Info |
|---|
Information for Editors |
Risk Assessment Summary
Rule | Severity | Likelihood | Detectable | Repairable | Priority | Level |
|---|---|---|---|---|---|---|
| STR30-C | Low | Likely | No | Yes | P6 | L2 |
| STR31-C | High | Likely | No | No | P9 | L2 |
| STR32-C | High | Probable | No | Yes | P12 | L1 |
| STR34-C | Medium | Probable | Yes | No | P8 | L2 |
| STR37-C | Low | Unlikely | Yes | Yes | P3 | L3 |
| STR38-C | High | Likely | Yes | No | P18 | L1 |
Recommendations
STR00-A. Represent characters using an appropriate type
STR01-A. Adopt and implement a consistent plan for managing strings
STR02-A. Sanitize data passed to complex subsystems
STR03-A. Do not inadvertently truncate a NULL-terminated byte string
STR04-A. Use plain char for characters in the basic character set
STR05-A. Use pointers to const when referring to string literals
STR06-A. Do not assume that strtok() leaves the parse string unchanged
STR07-A. Use TR 24731 for remediation of existing string manipulation code
STR08-A. Use managed strings for development of new string manipulation code
Rules
STR30-C. Do not attempt to modify string literals
STR32-C. Null-terminate byte strings as required
STR33-C. Size wide character strings correctly
STR34-C. Cast characters to unsigned types before converting to larger integer sizes
STR35-C. Do not copy data from an unbounded source to a fixed-length array
STR36-C. Do not specify the dimension of a character array initialized with a string literal
STR37-C. Arguments to character handling functions must be representable as an unsigned char
Risk Assessment Summary
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
STR00-A | medium | probable | low | P12 | L1 |
STR01-A | high | probable | high | P6 | L2 |
STR02-A | medium | likely | medium | P12 | L1 |
STR03-A | low | unlikely | medium | P2 | L3 |
STR04-A | low | unlikely | medium | P2 | L3 |
STR05-A | low | unlikely | high | P1 | L3 |
STR06-A | medium | probable | low | P12 | L1 |
STR07-A | high | probable | medium | P12 | L1 |
STR08-A | high | probable | high | P6 | L2 |
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
STR30-C | low | likely | low | P9 | L2 |
STR31-C | high | likely | medium | P18 | L1 |
STR32-C | high | probable | medium | P12 | L1 |
STR33-C | high | likely | medium | P18 | L1 |
STR34-C | medium | probable | medium | P8 | L2 |
STR35-C | high | likely | medium | P18 | L1 |
STR36-C | high | probable | low | P18 | L1 |
STR37-C | low | unlikely | low | P3 | L3 |
Related Rules and Recommendations
| Navigation Map | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
...
ARR38-C. Keep indexes and pointers within arrays in acceptable bounds. 06. Arrays (ARR) STR00-A. Represent characters using an appropriate type