SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 112

changes.mady.by.user Carol J. Lallier

Saved on

compared with

New Version 113

changes.mady.by.user Carol J. Lallier

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

ToolVersionCheckerDescription

LDRA tool suite

Include Page
LDRA_VLDRA_V

45 D

Fully implemented.

Fortify SCA

V. 5.0

  

Splint

Include Page
Splint_VSplint_V  Compass/ROSE  

Can detect violations of this rule. In particular, ROSE ensures that any pointer returned by malloc(), calloc(), or realloc() is first checked for NULL before being used (otherwise, it is free()-d). ROSE does not handle cases where an allocation is assigned to an lvalue that is not a variable (such as a struct member or C++ function call returning a reference).

Coverity

 

Include Page
Coverity_V
Coverity_V

CHECKED_RETURN

Finds instances where a pointer is checked against NULL and then later dereferenced.

Coverity

 
Include Page
Coverity_V
Coverity_V
 

NULL_RETURNS

 

Identifies functions that can return a null pointer but are not checked.

 

Coverity

 
Include Page
Coverity_V
Coverity_V
 

REVERSE_INULL

 

Identifies code that dereferences a pointer and then checks the pointer against NULL.

 

Coverity

 
Include Page
Coverity_V
Coverity_V
 

FORWARD_NULL

 

Can find the instances where NULL is explicitly dereferenced or a pointer is checked against NULL but then dereferenced anyway. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary.

Fortify SCA

5.0

  
 

Klocwork

 
Include Page
Klocwork_V
Klocwork_V
 

NPD.* *RNPD.*

 

LDRA tool suite

Include Page
LDRA_V
LDRA_V

45 D

Fully implemented.
PRQA QA-C
Include Page
PRQA_V
PRQA_V

0504  
0505  
0506  

Fully implemented.

Splint

Include Page
Splint_V
Splint_V
  

 

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

CERT C++ Secure Coding StandardEXP34-CPP. Ensure a null pointer is not dereferenced
CERT Oracle Secure Coding Standard for JavaEXP01-J. Never dereference null pointers
ISO/IEC TR 17961(Draft) Dereferencing an out-of-domain pointer [nullref]ISO/IEC TR 24772Pointer casting and pointer type changes [HFC] and
Null pointer dereference [XYH]
ISO/IEC TS 17961(Draft) Dereferencing an out-of-domain pointer [nullref]
MITRE CWECWE-476, NULL Pointer dereference

Bibliography

Section 6.3.2.3, "Pointers"
[Goodin 2009] [ISO/IEC 9899:2011]
[Jack 2007] 
[Liu 2009] 
[van Sprundel 2006] 
[Viega 2005]Section 5.2.18, "Null-Pointer Dereference"

...