Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Wiki Markup
Another library that uses dynamic allocation is the CERT managed string library.  The managed string library described in \[[Burch 06|AA. C References#Burch06]\] was developed in response to the need for a string library that could improve the quality and security of newly developed C language programs while eliminating obstacles to widespread adoption and possible standardization. The managed string library eliminates the possibility of unbounded copies, null-termination errors, and truncation by ensuring there is always adequate space available for the resulting string (including the terminating null character).  The primary advantage of the CERT managed string library, is that the source code is freely available so that the library can be adopted and customized as required by an organization.  

Risk Assessment

Wiki MarkupString handling functions defined in C99 \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.21 and elsewhere are susceptible to common programming errors that can lead to serious, exploitable [vulnerabilities|BB. Definitions#vulnerability]. Managed strings, when used properly, can eliminate many of these errors, particularly in new developmentFailing to adopt a consistent plan for managing strings within an application can lead to inconsistent decisions which may make it difficult to ensure system properties, such as adhering to safety requirements.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

STR01-A

low

unlikely

high

P3

L3

...