...
Static assertion is a valuable diagnostic tool for finding and eliminating software defects that may result in vulnerabilities at compile time. The absence of static assertions, however, does not mean that code is incorrect.
Recommendation | Severity | Likelihood |
|---|
Detectable | Repairable | Priority | Level |
|---|---|---|---|
DCL03-C | Low | Unlikely |
Yes | Yes |
P3 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Axivion Bauhaus Suite |
| CertC-DCL03 | |||||||
| Clang |
| misc-static-assert | Checked by clang-tidy | ||||||
| CodeSonar |
| (customization) | Users can implement a custom check that reports uses of the assert() macro | ||||||
| Compass/ROSE | Could detect violations of this rule merely by looking for calls to | ||||||||
| ECLAIR |
| CC2.DCL03 | Fully implemented | ||||||
| LDRA tool suite |
| 44 S | Fully implemented |
...