SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 80

changes.mady.by.user Robert Seacord

Saved on

compared with

New Version Current

changes.mady.by.user David Svoboda

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: REM Cost Reform

...

Note that this code does not prevent wrapping unless the unsigned long long type is at least 4 bits larger than size_t.

Noncompliant Code Example (size_t)

The mbstowcs() function converts a multibyte string to a wide character string, returning the number of characters converted. If an invalid multibyte character is encountered, mbstowcs() returns (size_t)(-1). Depending on how size_t is implemented, comparing the return value of mbstowcs() to signed integer literal -1 may not evaluate as expected.

Code Block
bgColor#FFcccc
langc
#include <stdlib.h>
 
void func(wchar_t *pwcs, const char *restrict s, size_t n) {
  size_t count_modified = mbstowcs(pwcs, s, n);
  if (count_modified == -1) {
    /* Handle error */
  }
}

Compliant Solution (size_t)

To ensure the comparison is properly performed, the return value of mbstowcs() should be compared against -1 cast to type size_t:

Code Block
bgColor#ccccff
langc
#include <stdlib.h>
 
void func(wchar_t *pwcs, const char *restrict s, size_t n) {
  size_t count_modified = mbstowcs(pwcs, s, n);
  if (count_modified == (size_t)-1) {
    /* Handle error */
  }
}

Risk Assessment

Failure to cast integers before comparing or assigning them to a larger integer size can result in software vulnerabilities that can allow the execution of arbitrary code by an attacker with the permissions of the vulnerable process.

Rule

Severity

Likelihood

Remediation Cost

Detectable

Repairable

Priority

Level

INT18-C

high

High

Likely

likely

No

medium

Yes

P18

L1

Automated Detection

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V

Supported, but no explicit checker
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V

LANG.TYPE.AWID
LANG.TYPE.OWID
LANG.CAST.VALUE
LANG.CAST.COERCE
ALLOC.SIZE.ADDOFLOW
ALLOC.SIZE.IOFLOW
ALLOC.SIZE.MULOFLOW
ALLOC.SIZE.SUBUFLOW
ALLOC.SIZE.TRUNC
MISC.MEM.SIZE.ADDOFLOW
MISC.MEM.SIZE.BAD
MISC.MEM.SIZE.MULOFLOW
MISC.MEM.SIZE.SUBUFLOW
MISC.MEM.SIZE.TRUNC

Expression value widened by assignment
Expression value widened by other operand
Cast alters value
Coercion alters value
Addition overflow of allocation size
Integer overflow of allocation size
Multiplication overflow of allocation size
Subtraction underflow of allocation size
Truncation of allocation size
Addition overflow of size
Unreasonable size argument
Multiplication overflow of size
Subtraction underflow of size
Truncation of size

Compass/ROSE

 

 



Can detect violations of this rule. It should look for patterns of (a op1 b) op2 c where

    • c has a bigger type than a or b
    • Neither a nor b is typecast to c's type
    • op2 is assignment or comparison
Coverity6.5OVERFLOW_BEFORE_WIDENFully
Implemented

Fortify SCA

5.0

 

Can detect violations of this rule with CERT C Rule Pack

implemented
Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C1890, C1891, C1892, C1893, C1894, C1895, C4490, C4491, C4492


Klocwork
Include Page
Klocwork_V
Klocwork_V

PORTING.CAST.SIZE


LDRA tool suite
Include Page
LDRA_V
LDRA_V
452 SPartially implemented
Parasoft C/C++test
Include Page
Parasoft_V
Parasoft_V

CERT_C-INT18-a
CERT_C-INT18-b
CERT_C-INT18-c

Avoid possible integer overflow in expressions in which the result is assigned to a variable of a wider integer type
Avoid possible integer overflow in expressions in which the result is compared to an expression of a wider integer type
Avoid possible integer overflow in expressions in which the result is cast to a wider integer type

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rec. INT18-C

Checks for integer overflow and unsigned integer overflow (rec. fully covered)

PRQA QA-C Include PagePRQA_VPRQA_V

1890
1891
1892
1893
1894
1895
2790 (C)

Partially implemented

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

SEI CERT C++
Secure
Coding StandardINT35-CPP. Evaluate integer expressions in a larger size before comparing or assigning to that size
ISO/IEC TR 24772:2013Numeric Conversion Errors [FLC]
MITRE CWECWE-681, Incorrect conversion between numeric types
CWE-190, Integer overflow (wrap or wraparound)

Bibliography

[Dowd 2006]Chapter 6, "C Language Issues"
[Seacord 2013]Chapter 5, "Integer Security"

...


...

Image Modified Image Modified Image Modified