SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 87

changes.mady.by.user Will Snavely

Saved on

compared with

New Version Current

changes.mady.by.user David Svoboda

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: REM Cost Reform

...

Failure to cast integers before comparing or assigning them to a larger integer size can result in software vulnerabilities that can allow the execution of arbitrary code by an attacker with the permissions of the vulnerable process.

Rule

Severity

Likelihood

Remediation Cost

Detectable

Repairable

Priority

Level

INT18-C

High

high

Likely

likely

No

medium

Yes

P18

L1

Automated Detection

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V

Supported, but no explicit checker
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V

LANG.TYPE.AWID
LANG.TYPE.OWID
LANG.CAST.VALUE
LANG.CAST.COERCE
ALLOC.SIZE.ADDOFLOW
ALLOC.SIZE.IOFLOW
ALLOC.SIZE.MULOFLOW
ALLOC.SIZE.SUBUFLOW
ALLOC.SIZE.TRUNC
MISC.MEM.SIZE.ADDOFLOW
MISC.MEM.SIZE.BAD
MISC.MEM.SIZE.MULOFLOW
MISC.MEM.SIZE.SUBUFLOW
MISC.MEM.SIZE.TRUNC

Addition Overflow of Allocation Size

Integer Overflow of Allocation Size

Multiplication Overflow of Allocation Size

Subtraction Underflow of Allocation Size

Truncation of Allocation Size

Addition Overflow of Size

Unreasonable Size Argument

Multiplication Overflow of Size

Subtraction Underflow of Size

Truncation of Size

Compass/ROSE

 

Expression value widened by assignment
Expression value widened by other operand
Cast alters value
Coercion alters value
Addition overflow of allocation size
Integer overflow of allocation size
Multiplication overflow of allocation size
Subtraction underflow of allocation size
Truncation of allocation size
Addition overflow of size
Unreasonable size argument
Multiplication overflow of size
Subtraction underflow of size
Truncation of size

Compass/ROSE
 



Can detect violations of this rule. It should look for patterns of (a op1 b) op2 c where

    • c has a bigger type than a or b
    • Neither a nor b is typecast to c's type
    • op2 is assignment or comparison
Coverity6.5OVERFLOW_BEFORE_WIDENFully
Implemented

Fortify SCA

5.0

 

Can detect violations of this rule with CERT C Rule Pack

PRQA QA-C Include PagePRQA QA-C_vPRQA QA-C_v

1890
1891
1892
1893
1894
1895
4490

4491

4492

Partially implemented
implemented
Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C1890, C1891, C1892, C1893, C1894, C1895, C4490, C4491, C4492


Klocwork
Include Page
Klocwork_V
Klocwork_V

PORTING.CAST.SIZE


LDRA tool suite
Include Page
LDRA_V
LDRA_V
452 SPartially implemented
Parasoft C/C++test
Include Page
Parasoft_V
Parasoft_V

CERT_C-INT18-a
CERT_C-INT18-b
CERT_C-INT18-c

Avoid possible integer overflow in expressions in which the result is assigned to a variable of a wider integer type
Avoid possible integer overflow in expressions in which the result is compared to an expression of a wider integer type
Avoid possible integer overflow in expressions in which the result is cast to a wider integer type

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rec. INT18-C

Checks for integer overflow and unsigned integer overflow (rec. fully covered)

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

SEI CERT C++ Coding StandardINT35-CPP. Evaluate integer expressions in a larger size before comparing or assigning to that size
ISO/IEC TR 24772:2013Numeric Conversion Errors [FLC]
MITRE CWECWE-681, Incorrect conversion between numeric types
CWE-190, Integer overflow (wrap or wraparound)

Bibliography

[Dowd 2006]Chapter 6, "C Language Issues"
[Seacord 2013]Chapter 5, "Integer Security"

...


...

Image Modified Image Modified Image Modified