SEI CERT C++ Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 4

changes.mady.by.user James Irving

Saved on

compared with

New Version 5

changes.mady.by.user James Irving

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

DCL38-CPP

med

unlikely

low

P8

L4

Automated Detection

The LDRA tool suite Version 7.6.0 can detect violations of this rule.

Fortify SCA Version 5.0 can detect violations when an array is declared in a function and then a pointer to that array is returned.

Splint Version 3.1.1 can detect violations of this rule.

Compass/ROSE can detect violations of this rule. It automatically detects returning pointers to local variables. Detecting more general cases, such as examples where static pointers are set to local variables which then go out of scope would be difficult.

The Coverity Prevent RETURN_LOCAL checker finds many instances where a function will return a pointer to a local stack variable. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary.

Klocwork Version 8.0.4.16 can detect violations of this rule with the LOCRET checker.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C Secure Coding Standard as DCL30-C. Declare objects with appropriate storage durations.

References

Wiki Markup
\[[Coverity 07|AA. C++ References#Coverity 07]\]
\[[ISO/IEC 14882-2003|AA. C++ References#ISO/IEC 14882-2003]\] SectionsSection 36.7, "Storage duration"; 3.8, "Object Lifetime"
\[[Henricson 97|AA. C++ References#Henricson 97]\] Rule 5.9, "A function must never return, or in any other way give access to, references or pointers to local variables outside the scope in which they are declared."
\[[Lockheed Martin 05|AA. C++ References#Lockheed Martin 05]\] AV Rule 111, "A function shall not return a pointer or reference to a non-static local object."
\[[ISO/IEC PDTR 24772|AA. C++ References#ISO/IEC PDTR 24772]\] "DCM Dangling references to stack frames"
\[[MISRA 04|AA. C++ References#MISRA 04]\] Rule 8.6Declaration Statement"

...

02. Declarations and Initialization (DCL)DCL17-CPP. Declare function parameters that are large data structures and are not changed by the function as const references      02. Declarations and Initialization (DCL)      DCL31-CPP. Do not define variadic functions03. Expressions (EXP)