Page History

...

When strings live on the heap, this rule is a specific instance of MEM35-C. Allocate sufficient memory for an object. Because strings are represented as arrays of characters, this rule is related to both ARR30-C. Do not form or use out-of-bounds pointers or array subscripts and ARR38-C. Guarantee that library functions do not form invalid pointers.

...

Tool

Version

Checker

Description

CodeSonar

Include Page

	CodeSonar_V
	CodeSonar_V

LANG.MEM.BO
LANG.MEM.TO
MISC.MEM.NTERM
BADFUNC.BO.*

Buffer Overrunoverrun
Type Overrunoverrun
No Space For Null Terminatorspace for null terminator
A collection of warning classes that report uses of library functions prone to internal buffer overflows.

Compass/ROSE

Can detect violations of the rule. However, it is unable to handle cases involving strcpy_s() or manual string copies such as the one in the first example

Coverity

6.5

STRING_OVERFLOW
STRING_SIZE
SECURE_CODING

Fully Implemented

Fully implemented

Fortify SCA

5.0

Klocwork

Include Page

	Klocwork_V
	Klocwork_V

NNTS.TAINTED
SV.STRBO.GETS
SV.USAGERULES.UNBOUNDED_STRING_COPY

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

Splint

Include Page

	Splint_V
	Splint_V

PRQA QA-C

Include Page

	PRQA QA-C_v
	PRQA QA-C_v

warncall for 'gets'

Partially implemented

...

VOID STR31-CPP. Guarantee that storage for character arrays has sufficient space for character data and the null terminator

CERT C Secure Coding Standard	STR03-C. Do not inadvertently truncate a string STR07-C. Use the bounds-checking interfaces for remediation of existing string manipulation code MSC24-C. Do not use deprecated or obsolescent functions MEM00-C. Allocate and free memory in the same module, at the same level of abstraction FIO34-C. Distinguish between characters read from a file and EOF or WEOF	SEI CERT C++ Coding Standard
ISO/IEC TR 24772:2013	String Termination [CJM] Buffer Boundary Violation (Buffer Overflow) [HCB] Unchecked Array Copying [XYW]
ISO/IEC TS 17961:2013	Using a tainted value to write to an object using a formatted input or output function [taintformatio] Tainted strings are passed to a string copying function [taintstrcpy]
MITRE CWE	CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120, Buffer Copy without Checking Size of Input ("Classic Buffer Overflow") CWE-193, Off-by-one Error

...

Space shortcuts

Page tree

Versions Compared

Old Version 176

New Version 177

Key