SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 34

changes.mady.by.user Justin Pincar

Saved on

compared with

New Version 35

changes.mady.by.user Justin Pincar

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
bgColor#ccccff
#include &lt;stdio.h&gt;<stdio.h>
#ifndef __USE_ISOC99
  /* reimplements vsnprintf() */
  #include &quot;"my_stdio.h&quot;"
#endif

Risk Assessment

Replacing secure functions with less secure functions is a very risky practice, because developers can be easily fooled into trusting the function to perform a security check that is absent. This may be a concern, for example, as developers attempt to adopt more secure functions, like the ISO/IEC TR 24731-1 functions (see STR07-C. Use TR 24731 for remediation of existing string manipulation code) that might not be available on all platforms.

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C++ Secure Coding Standard as PRE09-CPP. Do not replace secure functions with less secure functions.

References

Wiki Markup
\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.19.6.12, &quot;"The {{vsnprintf}} function&quot;"
\[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] &quot;"XYS Executing or Loading Untrusted Code&quot;"
\[[Open Group 04|AA. C References#Open Group 04]\] [{{vsnprintf()}}|http://www.opengroup.org/onlinepubs/009695399/functions/vsnprintf.html]
\[[Seacord 05a|AA. C References#Seacord 05]\] Chapter 6, &quot;"Formatted Output&quot;"
\[[VU#654390|AA. C References#VU#654390]\]

...

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;      01. Preprocessor (PRE)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;        PRE10-C. Wrap multi-statement macros in a do-while loop