Page History

ALLOC.SIZE.ADDOFLOW

ALLOC.SIZE.IOFLOW

ALLOC.SIZE.MULOFLOW

ALLOC.SIZE.SUBUFLOW

MISC.MEM.SIZE.ADDOFLOW

MISC.MEM.SIZE.BAD

MISC.MEM.SIZE.MULOFLOW

MISC.MEM.SIZE.SUBUFLOW

Addition Overflow of Allocation Size

Integer Overflow of Allocation Size

Multiplication Overflow of Allocation Size

Subtraction Underflow of Allocation Size

Addition Overflow of Size

Unreasonable Size Argument

Multiplication Overflow of Size

Subtraction Underflow of Size

Compass/ROSE

Can detect violations of this rule by ensuring that operations are checked for overflow before being performed. Be mindful of exception INT30-EX2 because it excuses many operations from requiring validation, including all the operations that would validate a potentially dangerous operation. For instance, adding two unsigned ints together requires validation involving subtracting one of the numbers from UINT_MAX, which itself requires no validation because it cannot wrap

Fortify SCA

5.0

Can detect violations of this rule with the CERT C Rule Pack

2910 (C)
2911 (D)
2912 (A)
2913 (S)
3302
3303
3304

INT02-C. Understand integer conversion rules
ARR30-C. Do not form or use out-of-bounds pointers or array subscripts
ARR36-C. Do not subtract or compare two pointers that do not refer to the same array
ARR37-C. Do not add or subtract an integer to a pointer to a non-array object
CON08-C. Do not assume that a group of calls to independently atomic methods is atomic