...
Code Block | ||||
---|---|---|---|---|
| ||||
static int *table = NULL; static size_t size = 0; int insert_in_table(size_t pos, int value) { if (size <= pos) { int *tmp = (int*)realloc(table, sizeof *table * (pos + 1)); if (NULL == tmp) return -1; /* indicate failure */ /* modifyModify size only after realloc succeeds */ size = pos + 1; table = tmp; } table[pos] = value; return 0; } |
...
Tool | Version | Checker | Description | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Compass/ROSE | Could be configured to catch violations of this rule. The way to catch the noncompliant code example is to first hunt for example code that follows this pattern: for (LPWSTR pwszTemp = pwszPath + 2; *pwszTemp != L'\\'; In particular, the iteration variable is a pointer, it gets incremented, and the loop condition does not set an upper bound on the pointer. Once this case is handled, we can handle cases like the real noncompliant code example, which is effectively the same semantics, just different syntax. | ||||||||||
| ARRAY_VS_SINGLETON NEGATIVE_RETURNS OVERRUN_STATIC OVERRUN_DYNAMIC | Can detect the access of memory past the end of a memory buffer/array. Can detect when the loop bound may become negative. Can detect the out-of-bound read/write to array allocated statically or dynamically. | |||||||||
| ABV.ITERATOR SV.TAINTED.LOOP_BOUND | ||||||||||
LDRA tool suite |
| 47 S | Partially implemented. | ||||||||
PRQA QA-C |
| 3680 3681 3682 3683 3685 (U) 3686 3688 3689 (U) 3690 3692 | Partially implemented. |
...
[Finlay 2003] | |
[Microsoft 2003] | |
[Pethia 2003] | |
[Seacord 2005a2013] | Chapter 1, "Running with Scissors" |
[Viega 2005] | Section 5.2.13, "Unchecked Array Indexing" |
[xorl 2009 ] | "CVE-2008-1517: Apple Mac OS X (XNU) Missing Array Index Validation" |
...