SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 182

changes.mady.by.user Michal Rozenau

Saved on

compared with

New Version 183

changes.mady.by.user Joerg Herter

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V
malloc-size-insufficientPartially checkedSupported, but no explicit checker
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V

ALLOC.SIZE.ADDOFLOW
ALLOC.SIZE.IOFLOW
ALLOC.SIZE.MULOFLOW
ALLOC.SIZE.SUBUFLOW
ALLOC.SIZE.TRUNC
IO.TAINT.SIZE
MISC.MEM.SIZE.BAD

Addition overflow of allocation size
Addition overflow of allocation size
Multiplication overflow of allocation size
Subtraction underflow of allocation size
Truncation of allocation size
Tainted allocation size
Unreasonable size argument

Compass/ROSE



Could check violations of this rule by examining the size expression to malloc() or memcpy() functions. Specifically, the size argument should be bounded by 0, SIZE_MAX, and, unless it is a variable of type size_t or rsize_t, it should be bounds-checked before the malloc() call. If the argument is of the expression a*b, then an appropriate check is

Code Block
if (a < SIZE_MAX / b && a > 0) ...

Coverity

Include Page
Coverity_V
Coverity_V

BAD_ALLOC_STRLEN

SIZECHECK (deprecated)

Partially implemented

Can find instances where string length is miscalculated (length calculated may be one less than intended) for memory allocation purposes. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary

Finds memory allocations that are assigned to a pointer that reference objects larger than the allocated block

Klocwork
Include Page
Klocwork_V
Klocwork_V

INCORRECT.ALLOC_SIZE


LDRA tool suite
Include Page
LDRA_V
LDRA_V
400 S, 487 S, 115 D
Enhanced enforcement
Splint3.1.1

Parasoft C/C++test
Include Page
Parasoft_V
Parasoft_V

CERT_C-MEM35-a

Do not use sizeof operator on pointer type to specify the size of the memory to be allocated via 'malloc', 'calloc' or 'realloc' function

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

Memory allocation with tainted size

Pointer access out of bounds

Wrong type used in sizeof

Size argument to memory function is from an unsecure source

Pointer dereferenced outside its bounds

sizeof argument does not match pointer type

PRQA QA-C
Include Page
PRQA QA-C_v
PRQA QA-C_v
0696, 0701, 1069, 1071, 1073
PRQA QA-C++4.2 2840, 2841, 2842, 2843, 2844 
PVS-Studio

Include Page
PVS-Studio_V
PVS-Studio_V

V531, V635, V641, V781
RuleChecker

Include Page
RuleChecker_V
RuleChecker_V

malloc-size-insufficientPartially checked

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...