SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 110

changes.mady.by.user Jill Britton

Saved on

compared with

New Version 111

changes.mady.by.user Carol J. Lallier

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

If a length field of −1 is supplied to the code in this noncompliant example, the addition wraps around to 0, and png_malloc() subsequently returns a null pointer, which is assigned to chunkdata. The chunkdata pointer is later used as a destination argument in a call to memcpy(), resulting in user-defined data overwriting memory starting at address 0. A write from or read to the memory address 0x0 will generally reference invalid or unused memory. In the case of the ARM and XScale architectures, the 0x0 address is mapped in memory and serves as the Exception Vector Tableexception vector table.

Compliant Solution

To correct this error, ensure the pointer returned by malloc() is not null. This also ensures compliance with MEM32-C. Detect and handle memory allocation errors.

...

ToolVersionCheckerDescription

LDRA tool suite

Include Page
LDRA_V
LDRA_V

45 D

Fully implemented.

Fortify SCA

V. 5.0

  

Splint

Include Page
Splint_V
Splint_V
  
Compass/ROSE  

Can detect violations of this rule. In particular, ROSE ensures that any pointer returned by malloc(), calloc(), or realloc() is first checked for NULL before being used (otherwise, it is free()-d). ROSE does not handle cases where an allocation is assigned to an lvalue that is not a variable (such as a struct member or C++ function call returning a reference).

Coverity

 

Include Page
Coverity_V
Coverity_V

CHECKED_RETURN

Finds instances where a pointer is checked against NULL and then later dereferenced.

Coverity

 
Include Page
Coverity_V
Coverity_V
 

NULL_RETURNS

 

Identifies functions that can return a null pointer but are not checked.

 

Coverity

 
Include Page
Coverity_V
Coverity_V
 

REVERSE_INULL

 

Identifies code that dereferences a pointer and then checks the pointer against NULL.

 

Coverity

 
Include Page
Coverity_V
Coverity_V
 

FORWARD_NULL

 

Can find the instances where NULL is explicitly dereferenced or a pointer is checked against NULL but then dereferenced anyway. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary.

 

Klocwork

 
Include Page
Klocwork_V
Klocwork_V
 

NPD.* *RNPD.*

 
PRQA QA-C
Include Page
PRQA_V
PRQA_V

0504  
0505  
0506  

Fully implemented.

 

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

CERT C++ Secure Coding Standard

...

EXP34-CPP. Ensure a null pointer is not dereferenced

...

CERT Oracle Secure Coding Standard for Java

...

EXP01-J. Never dereference null pointers
ISO/IEC

...

TR 17961(Draft) Dereferencing an out-of-domain pointer [nullref]
ISO/IEC TR 24772

...

Pointer casting and pointer type

...

changes [HFC] and Null pointer dereference

...

[XYH]
MITRE CWE

...

CWE-476,

...

NULL Pointer dereference

...

Bibliography

[Goodin 2009] 
[ISO/IEC 9899:2011]Section 6.3.2.3, "Pointers"
[Jack 2007] 
[Liu 2009] 
[van Sprundel 2006] 
[Viega 2005]Section 5.2.18, "Null-

...

Pointer Dereference"

...

png_charp