...
Always check that malloc() returns a non-null pointer, as per void MEM32ERR33-C. Detect and handle memory allocation standard library errors.
It is important to retain any pointer value returned by malloc() so that the referenced memory may eventually be deallocated. One possible way to preserve such a value is to use a constant pointer:
...
Arrays are a common source of vulnerabilities in C language programs because they are frequently used but not always fully understood.
Recommendation | Severity | Likelihood |
|---|
Detectable | Repairable | Priority | Level |
|---|---|---|---|
ARR00-C | High | Probable |
No | No | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| LANG.CAST.ARRAY.TEMP | Array to Pointer Conversion on Temporary Object | ||||||
| Klocwork |
| ABV.ANY_SIZE_ARRAY ABV.GENERAL ABV.GENERAL.MULTIDIMENSION ABV.ITERATOR ABV.MEMBER ABV.STACK ABV.TAINTED ABV.UNICODE.BOUND_MAP ABV.UNICODE.FAILED_MAP ABV.UNICODE.NNTS_MAP ABV.UNICODE.SELF_MAP ABV.UNKNOWN_SIZE NNTS.MIGHT NNTS.MUST NNTS.TAINTED SV.STRBO.BOUND_COPY.OVERFLOW SV.STRBO.BOUND_COPY.UNTERM SV.STRBO.BOUND_SPRINTF SV.STRBO.UNBOUND_COPY SV.STRBO.UNBOUND_SPRINTF SV.TAINTED.ALLOC_SIZE SV.TAINTED.CALL.INDEX_ACCESS SV.TAINTED.CALL.LOOP_BOUND SV.TAINTED.INDEX_ACCESS SV.TAINTED.LOOP_BOUND SV.UNBOUND_STRING_INPUT.CIN SV.UNBOUND_STRING_INPUT.FUNC | |||||||
| LDRA tool suite |
|
401 S
Partially implemented
45 D, 47 S, 489 S, 567 S, 64 X, 66 X, 68 X, 69 X, 70 X, 71 X | Partially implemented | ||||||||
| PC-lint Plus |
| 409, 413, 429, 613 | Partially supported: conceptually includes all other ARR items which are mapped to their respective guidelines; explicit mappings for ARR00 are present when a situation mentioned in the guideline itself is encountered |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
|---|---|---|
| CERT C |
| CTR00-CPP. Understand when to prefer vectors over arrays |
| Prior to 2018-01-12: CERT: Unspecified Relationship | |
| CWE 2.11 | CWE-119, |
| Improper Restriction of Operations within the Bounds of a Memory Buffer | Prior to 2018-01-12: CERT: | |
| CWE 2.11 | CWE-123, Write-what-where Condition | Prior to 2018-01-12: CERT: |
| CWE 2.11 | CWE-125, Out-of-bounds Read | Prior to 2018-01-12: CERT: |
| CWE 2.11 | CWE-129, Unchecked array indexing |
...
| Prior to 2018-01-12: CERT: |
...