Page History

array-index-range
array-index-range-constant
null-dereferencing
pointered-deallocation
return-reference-local

Partially checked

Can detect all accesses to invalid pointers as well as array index out-of-bounds accesses and prove their absence.

This rule is only partially checked as invalid but unused pointers may not be reported.

LANG.MEM.BO
LANG.MEM.BU

LANG.MEM.TBA

LANG.MEM.TO
LANG.MEM.TU

LANG.STRUCT.PBB
LANG.STRUCT.PPE

BADFUNC.BO.*

Buffer overrun
Buffer underrun

Tainted buffer access

Type overrun
Type underrun

Pointer before beginning of object
Pointer past end of object

A collection of warning classes that report uses of library functions prone to internal buffer overflows.

Could be configured to catch violations of this rule. The way to catch the noncompliant code example is to first hunt for example code that follows this pattern:

   for (LPWSTR pwszTemp = pwszPath + 2; *pwszTemp != L'\\';
   *pwszTemp++;)

In particular, the iteration variable is a pointer, it gets incremented, and the loop condition does not set an upper bound on the pointer. Once this case is handled, ROSE can handle cases like the real noncompliant code example, which is effectively the same semantics, just different syntax

Coverity

OVERRUN

NEGATIVE_RETURNS

ARRAY_VS_SINGLETON

BUFFER_SIZE

Can detect the access of memory past the end of a memory buffer/array

Can detect when the loop bound may become negative

Can detect the out-of-bound read/write to array allocated statically or dynamically

Can detect buffer overflows

Context sensitive analysis of array index, pointers, etc.

Array index out of bounds

Buffer overflow when calling various functions memset,strcpy,..

Warns about condition (a[i] == 0 && i < unknown_value) and recommends that (i < unknown_value && a[i] == 0) is used instead

Detects unsafe code when array is accessed before/after it is tested if the array index is out of bounds

C2820, C2821, C2822, C2823, C2840, C2841, C2842, C2843, C2930, C2931, C2932, C2933, C2935, C2936, C2937, C2938, C2950, C2951, C2952, C2953

C++2820, C++2821, C++2822, C++2823, C++2840, C++2841, C++2842, C++2843, C++2930, C++2931, C++2932, C++2933, C++2935, C++2936, C++2937, C++2938, C++2950, C++2951, C++2952, C++2953

ABV.ANY_SIZE_ARRAY
ABV.GENERAL
ABV.STACK
ABV.TAINTED
ABV.UNICODE.BOUND_MAP
ABV.UNICODE.FAILED_MAP
ABV.UNICODE.NNTS_MAP
ABV.UNICODE.SELF_MAP
ABV.UNKNOWN_SIZE
NNTS.MIGHT
NNTS.MUST
NNTS.TAINTED
SV.STRBO.BOUND_COPY.OVERFLOW
SV.STRBO.BOUND_COPY.UNTERM
SV.STRBO.BOUND_SPRINTF
SV.TAINTED.ALLOC_SIZE
SV.TAINTED.CALL.INDEX_ACCESS
SV.TAINTED.CALL.LOOP_BOUND
SV.TAINTED.INDEX_ACCESS
SV.TAINTED.LOOP_BOUND
SV.UNBOUND_STRING_INPUT.CIN
SV.UNBOUND_STRING_INPUT.FUNC

45 D, 47 S, 476 S, 489 S, 64 X, 66 X, 68 X, 69 X, 70 X, 71 X, 79 X

413, 415, 416, 613, 661, 662, 676

Fully supported

CERT C: Rule ARR30-C

Checks for:

• Array access out of bounds
• Pointer access out of bounds
• Array access with tainted index
• Use of tainted pointer
• Pointer dereference with tainted offset

Rule partially covered.

Exhaustively verified (see one compliant and one non-compliant example).