Assertions are a valuable diagnostic tool for finding and eliminating software defects that may result in vulnerabilities. (See MSC11-C. Incorporate diagnostic tests using assertions.) The runtime assert() macro has some limitations, however, in that it incurs a runtime overhead and because it calls abort(). Consequently, the runtime assert() macro is only useful for identifying incorrect assumptions and not for runtime error checking. As a result, runtime assertions are generally unsuitable for server programs or embedded systems.
...
For assertions involving only constant expressions, some implementations allow the use of a preprocessor conditional statement, as in this example:
...
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
Compass/ROSE |
|
| Could detect violations of this rule merely by looking for calls to | ||||||
| 44 S | Fully implemented. | |||||||
| ECLAIR |
| macrcall | Fully implemented. | ||||||
| PRQA QA-C |
| 2741 2742 | Fully Partially implemented |
Related Vulnerabilities
...
ISO/IEC 9899:2011 Section 6.10.1, "Conditional inclusion," section 6.10.3.3, "The ## operator," and section 7.2.1, "Program diagnostics"
Sources
[Becker 2008]
[Eckel 2007]
[Jones 2010]
[Klarer 2004]
[Saks 2005]
[Saks 2008]
...