...
INT31-C-EX3: The C Standard, subclause 7.29.2.5, paragraph 3 [ISO/IEC 9899:2024] says:
The time function returns the implementation’s best approximation to the current calendar time. The value (time_t)(-1) is returned if the calendar time is not available.
...
Integer truncation errors can lead to buffer overflows and the execution of arbitrary code by an attacker.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
INT31-C | High | Probable | No | HighYes | P6P12 | L2L1 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| Supported via MISRA C:2012 Rules 10.1, 10.3, 10.4, 10.6 and 10.7 | |||||||
| CodeSonar |
| LANG.CAST.PC.AV LANG.CAST.COERCE ALLOC.SIZE.TRUNC LANG.MEM.TBA | Cast: arithmetic type/void pointer Coercion alters value Truncation of allocation size Tainted buffer access | ||||||
| Compass/ROSE | Can detect violations of this rule. However, false warnings may be raised if | ||||||||
| NEGATIVE_RETURNS REVERSE_NEGATIVE MISRA_CAST | Can find array accesses, loop bounds, and other expressions that may contain dangerous implied integer conversions that would result in unexpected behavior Can find instances where a negativity check occurs after the negative value has been used for something else Can find instances where an integer expression is implicitly converted to a narrower integer type, where the signedness of an integer value is implicitly converted, or where the type of a complex expression is implicitly converted | |||||||
| Cppcheck |
| memsetValueOutOfRange | |||||||
| Cppcheck Premium |
| memsetValueOutOfRange premium-cert-int31-c | |||||||
| Helix QAC |
| C2850, C2855, C2890, C2895, C2900, C2905, C++2850, C++2855, C++2890, C++2895, C++2900, C++2905, C++3000, C++3010 DF2851, DF2852, DF2853, DF2856, DF2857, DF2858, DF2891, DF2892, DF2893, DF2896, DF2897, DF2898, DF2901, DF2902, DF2903, DF2906, DF2907, DF2908 | |||||||
| Klocwork |
| PORTING.CAST.SIZE | |||||||
| LDRA tool suite |
| 93 S, 433 S, 434 S | Partially implemented | ||||||
| Parasoft C/C++test |
| CERT_C-INT31-a | An expression of essentially Boolean type should always be used where an operand is interpreted as a Boolean value | ||||||
| Polyspace Bug Finder |
| Checks for:
Rule partially covered. | |||||||
| PVS-Studio |
| V562, V569, V642, V676, V716, V721, V724, V732, V739, V784, V793, V1019, V1029, V1046 | |||||||
| RuleChecker |
| Supported via MISRA C:2012 Rules 10.1, 10.3, 10.4, 10.6 and 10.7 | |||||||
| Security Reviewer - Static Reviewer |
| ClRVNU CmAD CmemleakOnRealloc CmissingReturn CMR CmVOOR CnAS | Fully implemented | ||||||
| TrustInSoft Analyzer |
| signed_downcast | Exhaustively verified. |
...