Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
bgColor#ccccff
langc
static int *table = NULL;
static size_t size = 0;

int insert_in_table(size_t pos, int value) {
  if (size <= pos) {
    int *tmp = (int*)realloc(table, sizeof *table * (pos + 1));
    if (NULL == tmp)
      return -1;   /* indicate failure */

    /* modifyModify size only after realloc succeeds */
    size  = pos + 1;
    table = tmp;
  }

  table[pos] = value;
  return 0;
}

...

Tool

Version

Checker

Description

Compass/ROSE

  

Could be configured to catch violations of this rule. The way to catch the noncompliant code example is to first hunt for example code that follows this pattern:

   for (LPWSTR pwszTemp = pwszPath + 2; *pwszTemp != L'\\';
*pwszTemp++;)

In particular, the iteration variable is a pointer, it gets incremented, and the loop condition does not set an upper bound on the pointer. Once this case is handled, we can handle cases like the real noncompliant code example, which is effectively the same semantics, just different syntax. 

Coverity

Include Page
Coverity_V
Coverity_V

ARRAY_VS_SINGLETON

NEGATIVE_RETURNS

OVERRUN_STATIC OVERRUN_DYNAMIC

Can detect the access of memory past the end of a memory buffer/array.

Can detect when the loop bound may become negative.

Can detect the out-of-bound read/write to array allocated statically or dynamically.

Klocwork

Include Page
Klocwork_V
Klocwork_V

ABV.ITERATOR SV.TAINTED.LOOP_BOUND

 
LDRA tool suite 
Include Page
LDRA_V
LDRA_V
 

47 S
476 S
64 X
68 X
69 X

 Partially implemented.
PRQA QA-C
Include Page
PRQA_V
PRQA_V
3680
3681
3682
3683
3685 (U)
3686
3688
3689 (U)
3690
3692
Partially implemented.

...

[Finlay 2003] 
[Microsoft 2003] 
[Pethia 2003] 
[Seacord 2005a2013]Chapter 1, "Running with Scissors"
[Viega 2005]Section 5.2.13, "Unchecked Array Indexing"
[xorl 2009 ]"CVE-2008-1517: Apple Mac OS X (XNU) Missing Array Index Validation"

...