...
Tool | Version | Checker | Description | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| Supported by taint analysis | |||||||||
| CodeSonar |
| IO.TAINT.SIZE (general) | Tainted allocation size CodeSonar will track the tainted value, along with any limits applied to it, and flag any problems caused by underconstraint. Warnings of a wide range of classes may be triggered, including tainted allocation size, buffer overrun, and division by zero | ||||||||
| KlocworkHelix QAC |
Klocwork_V |
| DF2794, DF2804, DF2854, DF2859, DF2864, DF2894, DF2899, DF2904, DF2909, DF2914, DF2924, DF2944, DF2949, DF2954, DF2956, DF2959 | ||||||||
| Klocwork |
| SV.TAINTED.ALLOC_SIZE SV.TAINTED.BINOP SV.TAINTED.SV.TAINTED.ALLOC_SIZE SV.TAINTED.BINOP SV.TAINTED.CALL.BINOP SV.TAINTED.CALL.INDEX_ACCESS SV.TAINTED.CALL.LOOP_BOUND SV.TAINTED.INDEX_ACCESS SV.TAINTED.LOOP_BOUND | |||||||||
| Parasoft C/C++test |
| CERT_C-INT04-a | Protect against integer overflow/underflow from tainted data | ||||||||
| Polyspace Bug Finder | R2016a |
| Checks for:
Loop bounded with tainted value Memory
Loop controlled by a value from an unsecure source Size argument to memory function is from an unsecure source Size of the variable-length array (VLA) is from an unsecure source and may be zero, negative, or too largeRec. partially supported. |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...