...
Confusion over which instructions are executed and which are not can lead to serious programming errors and vulnerabilities, including denial of service, abnormal program termination, and data integrity violation. This problem is mitigated by the use of interactive development environments (IDEs) and editors that use fonts, colors, or other mechanisms to differentiate between comments and code. However, the problem can still manifest, for example, when reviewing source code printed on a black-and-white printer.
Recommendation | Severity | Likelihood |
|---|
Detectable | Repairable | Priority | Level |
|---|---|---|---|
MSC04-C | Medium | Unlikely | Yes |
No | P4 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| mmline-comment | Partially checked | ||||||
| GCC |
|
Can detect violations of this rule when the | |||||||||
| CC2.MSC04 | Fully implemented | |||||||
| Helix QAC |
| C3108 | |||||||
| LDRA tool suite |
| 119 S, 302 S, 611 S | Partially implemented | ||||||
| Parasoft C/C++test |
| CERT_C-MSC04-a | The character sequence /* shall not be used within a C-style comment | |||||||
| PC-lint Plus |
| 1, 427, 602, 689, 853, | Fully supported | ||||||
| Polyspace Bug Finder |
| Checks for use of /* and // within a comment (rule partially covered) | |||||||
| RuleChecker |
| mmline-comment | Partially checked |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| SEI CERT C++ Coding Standard | VOID MSC04-CPP. Use comments consistently and in a readable fashion |
| MISRA C:2012 | Rule 1.2 (advisory) |
Bibliography
...
...