...
Static assertion is a valuable diagnostic tool for finding and eliminating software defects that may result in vulnerabilities at compile time. The absence of static assertions, however, does not mean that code is incorrect.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
DCL03-C | Low | Unlikely | High | P1 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Axivion Bauhaus Suite |
| CertC-DCL03 | |||||||
| Clang |
| misc-static-assert | Checked by clang-tidy | ||||||
| CodeSonar |
| (customization) | Users can implement a custom check that reports uses of the assert() macro | ||||||
| Compass/ROSE |
Could detect violations of this rule merely by looking for calls to | |||||||||
| ECLAIR |
| CC2.DCL03 | Fully implemented | ||||||
| LDRA tool suite |
| 44 S | Fully implemented |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| C++ Secure Coding Standard | VOID DCL03-CPP. Use a static assertion to test the value of a constant expression |
Bibliography
| [Becker 2008] |
| [Eckel 2007] |
| [ISO/IEC 9899:2011] | Subclause 6.7.10, "Static Assertions" |
| [Jones 2010] |
| [Klarer 2004] |
| [Saks 2005] |
| [Saks 2008] |
...
...