...
Replacing secure functions with less secure functions is a very risky practice because developers can be easily fooled into trusting the function to perform a security check that is absent. This may be a concern, for example, as developers attempt to adopt more secure functions , such as the C11 Annex K functions, that might not be available on all platforms. (See VOID STR07-C. Use the bounds-checking interfaces for string manipulation.)
Recommendation | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
PRE09-C | High | Likely | Yes | NoMedium | P18 | L1 |
Automated Detection
| Tool | Version | Checker | Description | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| Supported, but no explicit checker | ||||||||||||||
| Axivion Bauhaus Suite |
| CertC-PRE09 | ||||||||||||||
| Cppcheck Premium |
| premium-cert-pre09-c | ||||||||||||||
| Helix QAC |
| C5003 | ||||||||||||||
| Polyspace Bug Finder |
| Checks for:
|
| PRQA QA-C | ||||||||||||
| Include Page | PRQA QA-C_v | PRQA QA-C_v | 5003 | Fully implemented
Rec. fully covered. |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...