SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 139

changes.mady.by.user Will Snavely

Saved on

compared with

New Version Current

changes.mady.by.user Jill Britton

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
bgColor#CCCCFF
langc
int buf[INTBUFSIZE];
int *buf_ptr = buf;

while (havedata() && buf_ptr < &buf[INTBUFSIZE]) {
  *buf_ptr++ = parseint(getdata());
}

...

Failure to understand and properly use pointer arithmetic can allow an attacker to execute arbitrary code.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

EXP08-C

High

Probable

High

P6

L2

Automated Detection

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V

Supported: Astrée reports potential runtime errors resulting from invalid pointer arithmetics.
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V

LANG.STRUCT.PARITH
LANG.MEM.BO
LANG.MEM.BU
LANG.STRUCT.PBB
LANG.STRUCT.PPE
LANG.MEM.TBA
LANG.MEM.TO
LANG.MEM.TU
LANG.STRUCT.CUP
LANG.STRUCT.SUP

Pointer arithmetic
Buffer overrun
Buffer underrun
Pointer before beginning of object
Pointer past end of object
Tainted buffer access
Type overrun
Type underrun
Comparison of Unrelated Pointers
Subtraction of Unrelated Pointers

Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C0488, C2930, C2931, C2932, C2933


Klocwork
Include Page
Klocwork_V
Klocwork_V
ABV.ITERATOR
ABV.GENERAL
ABV.GENERAL.MULTIDIMENSION
LDRA tool suite
Include Page
LDRA_V
LDRA_V

45 D
53 D
54 D
438 S
576 S

Partially implemented

Parasoft C/C++test
9.5

MISRA-101

BD-PB-ARRAY

Checks all array access, not just pointer arithmetic
Include Page
Parasoft_V
Parasoft_V

CERT_C-EXP08-a
CERT_C-EXP08-b


Pointer arithmetic should not be used
Avoid accessing arrays out of bounds

Parasoft Insure++
  Runtime analysis for over- or under- read or write


Runtime analysis
PC-lint Plus

Include Page
PC-lint Plus_V
PC-lint Plus_V

416

Partially supported

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder

R2016a

Incorrect pointer scaling

Pointer access out of bounds

Implicit scaling in pointer arithmetic might be ignored

Pointer dereferenced outside its bounds

PRQA QA-C Include PagePRQA QA-C_vPRQA QA-C_v

0488, 2930, 2931, 2932, 2933, 2934

Partially implemented

 

_V

CERT C: Rec. EXP08-C


Checks for:

  • Pointer points outside array after arithmetic on pointer operand
  • Subtraction between pointers to different arrays
  • Incorrect pointer scaling

Rec. fully supported.

PVS-Studio

Include Page
PVS-Studio_V
PVS-Studio_V

V503, V520, V574, V600, V613, V619, V620, V643, V650, V687, V769, V1004

How long is 4 yards plus 3 feet? It is obvious from elementary arithmetic that any answer involving 7 is wrong, as the student did not take the units into account. The right method is to convert both numbers to reflect the same units.

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

SEI CERT C++ Coding StandardVOID EXP08-CPP. Ensure pointer arithmetic is used correctly
ISO/IEC TR 24772:2013Pointer Casting and Pointer Type Changes [HFC]
Pointer Arithmetic [RVG]
ISO/IEC TS 17961Forming or using out-of-bounds pointers or array subscripts [invptr]
MISRA C:2012Rule 18.1 (required)
Rule 18.2 (required)
Rule 18.3 (required)
Rule 18.4 (advisory)
MITRE CWECWE-468, Incorrect pointer scaling

Bibliography

[Dowd 2006]Chapter 6, "C Language Issues"
[Murenin 2007]
 

...



...

Image Modified Image Modified Image Modified