...
Using an invalid iterator range is similar to allowing a buffer overflow, which can lead to an attacker running arbitrary code.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
CTR53-CPP | High | Probable | High | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description |
|---|---|---|---|
| Parasoft C/C++test |
|
|
| STL-36 |
| PRQA QA-C | 4.1 | 3802 |
| PRQA QA-C++ |
| 3802 |
| PVS-Studio | 6.22 | V539, V662, V789 | General analysis rule set |
Related Vulnerabilities
In Fun with erase(), Chris Rohlf discusses the exploit potential of a program that calls vector::erase() with invalid iterator ranges [Rohlf 2009].
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| SEI CERT C++ Coding Standard | CTR51-CPP. Use valid references, pointers, and iterators to reference elements of a container CTR57-CPP. Provide a valid ordering predicate |
Bibliography
| [ISO/IEC 14882-2014] | Clause 24, "Iterators Library" |
| [Meyers 2001] | Item 32, "Follow Remove-Like Algorithms with erase If You Really Want to Remove Something" |
...
...