...
Wiki Markup |
---|
Another library that uses dynamic allocation is the CERT managed string library. The managed string library described in \[[Burch 06|AA. C References#Burch06]\] was developed in response to the need for a string library that could improve the quality and security of newly developed C language programs while eliminating obstacles to widespread adoption and possible standardization. The managed string library eliminates the possibility of unbounded copies, null-termination errors, and truncation by ensuring there is always adequate space available for the resulting string (including the terminating null character). The primary advantage of the CERT managed string library, is that the source code is freely available so that the library can be adopted and customized as required by an organization. |
Risk Assessment
String handling functions defined in C99 \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.21 and elsewhere are susceptible to common programming errors that can lead to serious, exploitable [vulnerabilities|BB. Definitions#vulnerability]. Managed strings, when used properly, can eliminate many of these errors, particularly in new developmentFailing to adopt a consistent plan for managing strings within an application can lead to inconsistent decisions which may make it difficult to ensure system properties, such as adhering to safety requirements. Wiki Markup
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
STR01-A | low | unlikely | high | P3 | L3 |
...