...
- Do not need to set
errnoon an error. - Have undefined behavior if the value of the result cannot be represented. (See undefined behavior 119118 of Annex J of the C Standard.)
- Return 0 if the string does not represent an integer (which is indistinguishable from a correctly formatted, zero-denoting input string), but the C Standard only specifies the behavior of these functions on success.
...
Recommendation | Severity | Likelihood | Detectable | Remediation CostRepairable | Priority | Level |
|---|---|---|---|---|---|---|
ERR07-C | Medium | Probable | Yes | MediumYes | P8P12 | L2L1 |
Automated Detection
This rule in general cannot be detected, although various examples can be detected by simply scanning for functions that have equivalent functions with better error handling.
Tool | Version | Checker | Description | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| bad-function | Fully checked | ||||||||||
| Axivion Bauhaus Suite |
| CertC-ERR07 | |||||||||||
| Helix QAC |
| C5046 | |||||||||||
| LDRA tool suite |
| 44 S, 593 S, 594 S | Partially implemented | ||||||||||
| Parasoft C/C++test |
| CERT_C-ERR07-a | The | library functions 'atof', 'atoi | and atol from library ', 'atol' and 'atoll' functions from the 'stdlib.h | shall ' or 'cstdlib' library should not be used | Standard Library input/output functions shall not be usedlibrary functions 'rewind', 'setbuf' and 'ctime' should not be used | ||||||
| PC-lint Plus |
| 586 | Fully supported | ||||||||||
| RuleChecker |
| bad-function | Fully checked |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...