...
Arrays are a common source of vulnerabilities in C language programs because they are frequently used but not always fully understood.
Recommendation | Severity | Likelihood |
|---|
Detectable | Repairable | Priority | Level |
|---|---|---|---|
ARR00-C | High | Probable |
No | No | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| LANG.CAST.ARRAY.TEMP | Array to Pointer Conversion on Temporary Object | ||||||
| Helix QAC |
| C0304, C0450, C0453, C0455, C0459, C0464, C0465, C0491, C0590, C0642, C0676, C0677, C0678, C0680, C0686, C0687, C0688, C0691, C0710, C0711, C0941, C1037, C1051, C1052, C1121, C1122, C1123, C1188, C1189, C1312, C2668, C2669, C2781, C2782, C2783, C2810, C2811, C2812, C2813, C2814, C2820, C2821, C2822, C2823, C2824, C2840, C2841, C2842, C2843, C2845, C2846, C2847, C2848, C2950, C2951, C2952, C2953, C3337, C3405, C3639, C3640, C3650, C3651, C3674, C3684, C4500, C4510 | |||||||
| Klocwork |
| ABV.ANY_SIZE_ARRAY ABV.GENERAL ABV.GENERAL.MULTIDIMENSION ABV.ITERATOR ABV.MEMBER ABV.STACK ABV.TAINTED ABV.UNICODE.BOUND_MAP ABV.UNICODE.FAILED_MAP ABV.UNICODE.NNTS_MAP ABV.UNICODE.SELF_MAP ABV.UNKNOWN_SIZE NNTS.MIGHT NNTS.MUST NNTS.TAINTED SV.STRBO.BOUND_COPY.OVERFLOW SV.STRBO.BOUND_COPY.UNTERM SV.STRBO.BOUND_SPRINTF SV.STRBO.UNBOUND_COPY SV.STRBO.UNBOUND_SPRINTF SV.TAINTED.ALLOC_SIZE SV.TAINTED.CALL.INDEX_ACCESS SV.TAINTED.CALL.LOOP_BOUND SV.TAINTED.INDEX_ACCESS SV.TAINTED.LOOP_BOUND SV.UNBOUND_STRING_INPUT.CIN SV.UNBOUND_STRING_INPUT.FUNC | |||||||
| LDRA tool suite |
| 45 D, 47 S, 489 S, 567 S, 64 X, 66 X, 68 X, 69 X, 70 X, 71 X | Partially implemented |
sizeof operator can cause unintended results| PC-lint Plus |
| 409, 413, 429, 613 | Partially supported: conceptually includes all other ARR items which are mapped to their respective guidelines; explicit mappings for ARR00 are present when a situation mentioned in the guideline itself is encountered |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
|---|---|---|
| CERT C |
| CTR00-CPP. Understand when to prefer vectors over arrays |
| Prior to 2018-01-12: CERT: Unspecified Relationship | ||
| CWE 2.11 | CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer | Prior to 2018-01-12: CERT: |
| CWE 2.11 | CWE-123, Write-what-where Condition | Prior to 2018-01-12: CERT: |
| CWE 2.11 | CWE-125, Out-of-bounds Read | Prior to 2018-01-12: CERT: |
| CWE 2.11 | CWE-129, Unchecked array indexing |
...
| Prior to 2018-01-12: CERT: |
...