Recommendations
INT00-A. Understand the data model used by your implementation(s)
INT01-A. Use rsize_t or size_t for all integer values representing the size of an object
INT02-A. Understand integer conversion rules
INT03-A. Use a secure integer library
INT04-A. Enforce limits on integer values originating from untrusted sources
INT06-A. Use strtol() or a related function to convert a string token to an integer
INT07-A. Use only explicitly signed or unsigned char type for numeric values
INT08-A. Verify that all integer values are in range
INT09-A. Ensure enumeration constants map to unique values
INT10-A. Do not assume a positive remainder when using the % operator
INT11-A. Take care when converting from pointer to integer or integer to pointer
INT12-A. Do not make assumptions about the type of a plain int bit-field when used in an expression
INT13-A. Use bitwise operators only on unsigned operands
INT14-A. Avoid performing bitwise and arithmetic operations on the same data
INT15-A. Use intmax_t or uintmax_t for for formatted IO on user defined integer types
Rules
INT30-C. Ensure that unsigned integer operations do not wrap
INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data
INT32-C. Ensure that operations on signed integers do not result in overflow
INT33-C. Ensure that division and modulo operations do not result in divide-by-zero errors
INT34-C. Do not shift a negative number of bits or more bits than exist in the operand
INT35-C. Evaluate integer expressions in a larger size before comparing or assigning to that size
Risk Assessment Summary
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
INT00-A |
low |
unlikely |
high |
P1 |
L3 |
INT01-A |
medium |
probable |
medium |
P8 |
L2 |
INT02-A |
medium |
probable |
medium |
P8 |
L2 |
INT03-A |
medium |
probable |
high |
P4 |
L3 |
INT04-A |
low |
probable |
high |
P2 |
L3 |
INT05-A |
medium |
probable |
high |
P4 |
L3 |
INT06-A |
medium |
probable |
medium |
P8 |
L2 |
INT07-A |
medium |
probable |
medium |
P8 |
L2 |
INT08-A |
medium |
probable |
high |
P4 |
L3 |
INT09-A |
low |
unlikely |
low |
P3 |
L3 |
INT10-A |
low |
unlikely |
medium |
P2 |
L3 |
INT11-A |
low |
unlikely |
medium |
P2 |
L3 |
INT12-A |
low |
unlikely |
medium |
P2 |
L3 |
INT13-A |
high |
unlikely |
medium |
P6 |
L2 |
INT14-A |
medium |
unlikely |
medium |
P4 |
L3 |
INT15-A |
low |
likely |
medium |
P6 |
L2 |
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
INT30-C |
high |
likely |
high |
P9 |
L2 |
INT31-C |
high |
probable |
high |
P6 |
L2 |
INT32-C |
high |
likely |
high |
P9 |
L2 |
INT33-C |
low |
probable |
medium |
P4 |
L3 |
INT34-C |
high |
probable |
medium |
P12 |
L1 |
INT35-C |
high |
likely |
medium |
P18 |
L1 |
Related Rules and Recommendations
|
|
|
|
EXP39-C. Avoid side effects in assertions 03. Expressions (EXP) INT00-A. Understand the data model used by your implementation(s)