...
Modifying string literals can lead to abnormal program termination and possibly denial-of-service attacks.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
STR30-C | Low | Likely | Low | P9 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||
|---|---|---|---|---|---|---|---|
| Astrée |
|
| Supported, but no explicit checker | |
| Compass/ROSE |
Can detect simple violations of this rule | |||||||||
| Coverity |
| PW | Deprecates conversion from a string literal to "char *" | ||||||
| LDRA tool suite |
| 157 S | Partially implemented | ||||||
| Parasoft C/C++test |
|
|
| PB-27 |
| Polyspace Bug Finder | R2016a | Writing to const qualified object | Object declared with a | ||||||
| PRQA QA-C |
| 0556 | Partially implemented | ||||||
| Splint |
|
| PRQA QA-C++ | 4.2 | 3063, 3064, 3605, 3606, 3607, 3842 |
| PVS-Studio | 6.22 | V675 | General analysis rule |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
|---|---|---|
| CERT C Secure Coding Standard | EXP05-C. Do not cast away a const qualification | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT C Secure Coding Standard | STR11-C. Do not specify the bound of a character array initialized with a string literal | Prior to 2018-01-12: CERT: Unspecified Relationship |
| ISO/IEC TS 17961:2013 | Modifying string literals [strmod] | Prior to 2018-01-12: CERT: Unspecified Relationship |
Bibliography
| [ISO/IEC 9899:2011] | 6.4.5, "String Literals" |
| [Plum 1991] | Topic 1.26, "Strings—String Literals" |
| [Summit 1995] | comp.lang.c FAQ List, Question 1.32 |
...
...