You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 65 Next »

C checkers

CERT C Secure Coding Standard

ARRAY_VS_SINGLETON

VOID Do not allow loops to iterate beyond the end of an array

ASSERT_SIDE_EFFECT

EXP31-C. Avoid side effects in assertions

ASSERT_SIDE_EFFECT

MSC11-C. Incorporate diagnostic tests using assertions

BAD_COMPARE

MSC02-C. Avoid errors of omission

BAD_ALLOC_STRLEN

MEM35-C. Allocate sufficient memory for an object

BAD_COMPARE

MSC02-C. Avoid errors of omission

BAD_FREE

MEM34-C. Only free memory allocated dynamically

CHAR_IO

FIO34-C. Use int to capture the return value of character IO functions

CHECKED_RETURN

FIO33-C. Detect and handle input output errors resulting in undefined behavior

CHECKED_RETURN

FIO04-C. Detect and handle input and output errors

CHECKED_RETURN

EXP12-C. Do not ignore values returned by functions

CHECKED_RETURN

MEM32-C. Detect and handle memory allocation errors

CONSTANT_EXPRESSION_RESULT

EXP17-C. Do not perform bitwise operations in conditional expressions

DEADCODE

MSC07-C. Detect and remove dead code

EVALUATION_ORDER

EXP10-C. Do not depend on the order of evaluation of subexpressions or the order in which side effects take place

EVALUATION_ORDER

EXP30-C. Do not depend on order of evaluation between sequence points

FORWARD_NULL

EXP34-C. Do not dereference null pointers

INFINITE_LOOP

VOID Beware of infinite loops

MISRA_CAST

INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data

MISRA_CAST

FLP34-C. Ensure that floating point conversions are within range of the new type

MISSING_BREAK

MSC17-C. Finish every set of statements associated with a case label with a break statement

MISSING_RETURN

MSC02-C. Avoid errors of omission

NEGATIVE_RETURNS

INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data

NEGATIVE_RETURNS

VOID Guarantee that array indices are within the valid range

NEGATIVE_RETURNS

ARR32-C. Ensure size arguments for variable length arrays are in a valid range

NEGATIVE_RETURNS

VOID Do not allow loops to iterate beyond the end of an array

NO_EFFECT

MSC12-C. Detect and remove code that has no effect

NULL_RETURNS

EXP34-C. Do not dereference null pointers

OVERRUN_DYNAMIC

VOID Do not allow loops to iterate beyond the end of an array

OVERRUN_DYNAMIC

STR35-C. Do not copy data from an unbounded source to a fixed-length array

OVERRUN_STATIC

VOID Do not allow loops to iterate beyond the end of an array

OVERRUN_STATIC

STR35-C. Do not copy data from an unbounded source to a fixed-length array

RESOURCE_LEAK

MEM31-C. Free dynamically allocated memory exactly once

RETURN_LOCAL

DCL30-C. Declare objects with appropriate storage durations

REVERSE_INULL

EXP34-C. Do not dereference null pointers

REVERSE_NEGATIVE

ARR32-C. Ensure size arguments for variable length arrays are in a valid range

REVERSE_NEGATIVE

INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data

STACK_USE

MEM05-C. Avoid large stack allocations

SIZECHECK

MEM35-C. Allocate sufficient memory for an object

UNINIT

EXP33-C. Do not reference uninitialized memory

UNUSED_VALUE

MSC13-C. Detect and remove unused values

USE_AFTER_FREE

MEM00-C. Allocate and free memory in the same module, at the same level of abstraction

USE_AFTER_FREE

MEM01-C. Store a new value in pointers immediately after free()

USE_AFTER_FREE

MEM30-C. Do not access freed memory

USE_AFTER_FREE

MEM31-C. Free dynamically allocated memory exactly once

VARARGS

No equivalent

C++ Checkers

CERT C++ Secure Coding Standard

BAD_OVERRIDE

No equivalent

CTOR_DTOR_LEAK

No equivalent

DELETE_ARRAY

No equivalent

INVALIDATE_ITERATOR

https://www.securecoding.cert.org/confluence/display/cplusplus/STL30-C.+Use+Valid+Iterators

PASS_BY_VALUE

No equivalent

UNCAUGHT_EXCEPT

https://www.securecoding.cert.org/confluence/display/cplusplus/ERR30-C.+Check+for+all+error+conditions

UNINIT_CTOR

No equivalent

WRAPPER_ESCAPE

No equivalent

Concurrency Checkers

CERT C Secure Coding Standard

LOCK

Out of scope

ORDER_REVERSAL

Out of scope

SLEEP

Out of scope

Security checkers

CERT C Secure Coding Standard

BUFFER_SIZE

STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator, ARR33-C. Guarantee that copies are made into storage of sufficient size

CHROOT

Out of scope

OPEN_ARGS

FIO03-C. Do not make assumptions about fopen() and file creation

READLINK

POS30-C. Use the readlink() function properly

SECURE_CODING

STR35-C. Do not copy data from an unbounded source to a fixed-length array, others?

SECURE_TEMP

FIO43-C. Do not create temporary files in shared directories, TMPxx-C. Temporary file names must be unique when the file is created

STRING_OVERFLOW

STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator

STRING_NULL

STR32-C. Null-terminate byte strings as required

STRING_SIZE

STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator

TAINTED_SCALAR

VOID Guarantee that array indices are within the valid range, INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data, INT32-C. Ensure that operations on signed integers do not result in overflow

TAINTED_STRING

STR02-C. Sanitize data passed to complex subsystems, FIO30-C. Exclude user input from format strings, FIO02-C. Canonicalize path names originating from untrusted sources

TOCTOU

FIO03-C. Do not make assumptions about fopen() and file creation, FIO01-C. Be careful using functions that use file names for identification, FIO08-C. Take care when calling remove() on an open file, others?

USER_POINTER

No equivalent

  • No labels