Page History

Detects calls to unsafe string function that may cause buffer overflow
Detects potential buffer overruns, including those caused by incorrect usage of fscanf()

LANG.MEM.BO
LANG.MEM.TO
MISC.MEM.NTERM
BADFUNC.BO.*

Buffer overrun
Type overrun
No space for null terminator
A collection of warning classes that report uses of library functions prone to internal buffer overflows

Compass/ROSE

Can detect violations of the rule. However, it is unable to handle cases involving strcpy_s() or manual string copies such as the one in the first example

STRING_OVERFLOW

BUFFER_SIZE

OVERRUN

STRING_SIZE

Fully implemented

Fortify SCA

5.0

Klocwork

NNTS.MIGHT
NNTS.MUST
SV.STRBO.BOUND_COPY.OVERFLOW
SV.STRBO.BOUND_COPY.UNTERM
SV.STRBO.BOUND_SPRINTF
SV.STRBO.UNBOUND_COPY
SV.STRBO.UNBOUND_SPRINTF

LDRA tool suite

489 S, 109 D, 66 X, 70 X, 71 X

Partially implemented

CERT_C-STR31-a
CERT_C-STR31-b
CERT_C-STR31-c
CERT_C-STR31-d
CERT_C-STR31-e

Avoid accessing arrays out of bounds
Avoid overflow when writing to a buffer
Prevent buffer overflows from tainted data
Avoid buffer write overflow from tainted data
Avoid using unsafe string functions which may cause buffer overflows

Array access out of bounds

Buffer overflow from incorrect string format specifier

Destination buffer overflow in string manipulation

Invalid use of standard library string routine

Missing null in string array

Pointer access out of bounds

Tainted NULL or non-null-terminated string

Use of dangerous standard function

Array index outside bounds during array access

String format specifier causes buffer argument of standard library functions to overflow

Function writes to buffer at offset greater than buffer size

Standard library string function called with invalid arguments

String does not terminate with null character

Pointer dereferenced outside its bounds

Argument is from an unsecure source and may be NULL or not NULL-terminated

Dangerous functions cause possible buffer overflow in destination buffer

Splint