SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 135

changes.mady.by.user Michal Rozenau

Saved on

compared with

New Version Current

changes.mady.by.user Anirban Gangopadhyay

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V

Supported, but no explicit checker
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V
(customization)Users can add a custom check for allocator calls with size argument 0 (this includes literal 0, underconstrained tainted values, and computed values). 
Compass/ROSE



Can detect some violations of this rule. In particular, it warns when the argument to malloc() is a variable that has not been compared against 0 or that is known at compile time to be 0

Parasoft C/C++test

Include Page
Parasoft_V
Parasoft_V

CERT_C-MEM04-aThe validity of values passed to library functions shall be checked
Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rec. MEM04-C


Checks for:

Tainted sign change conversion

Tainted size of variable length array

  • Variable length array with nonpositive size

Value from an unsecure source changes sign

Size of the variable-length array (VLA) is from an unsecure source and may be zero, negative, or too large

  • Tainted sign change conversion
  • Tainted size of variable length array

Rec. fully covered.

Size of variable-length array is zero or negative

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...