SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 43

changes.mady.by.user David Svoboda

Saved on

compared with

New Version Current

changes.mady.by.user Caden Milne

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Updated references from C11->C23

...

CERT_C-POS54-b
CERT_C-POS54-c function having non-void return type shall be used
The value returned by a function having non-void return type shall be used
Avoid null pointer dereferencing

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V

error-information-unused

error-information-unused-computed

Supported
Axivion Bauhaus Suite

Include Page
Axivion Bauhaus Suite_V
Axivion Bauhaus Suite_V

CertC-POS54
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V
LANG.FUNCS.IRV
LANG.ERRCODE.NOTEST
LANG.ERRCODE.NZ
Ignored return value
Missing Test of Error Code
Non-zero Error Code
Compass/ROSE

Can detect violations of this recommendation when checking for violations of EXP12-C. Do not ignore values returned by functions and EXP34-C. Do not dereference null pointers

Coverity

Include Page
Coverity_V
Coverity_V

CHECKED_RETURN

Finds inconsistencies in how function call return values are handled. Coverity Prevent cannot discover all violations of this recommendation, so further verification is necessary

Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C3200
Klocwork
Include Page
Klocwork_V
Klocwork_V
SV.RVT.RETVAL_NOTTESTED
LDRA tool suite
Include Page
LDRA_V
LDRA_V

80 D

Partially implemented
Parasoft C/C++test
Include Page
Parasoft_V
Parasoft_V

CERT_C-POS54-a

The value returned by a

POSIX library function that may return an error should be used

PC-lint Plus

Include Page
PC-lint Plus_V
PC-lint Plus_V

413, 534, 613

Assistance provided

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rule POS54-CChecks for situations where return value of a sensitive function is not checked (rule fully covered)
PRQA QA-CRuleChecker

Include Page

PRQA QA-C_vPRQA QA-C_v

3200

RuleChecker_V
RuleChecker_V

error-information-unused

SupportedPartially implemented

Related Vulnerabilities

The vulnerability in Adobe Flash [VU#159523] arises because Flash neglects to check the return value from calloc(). Even when calloc() returns NULL, Flash writes to an offset from the return value. Dereferencing NULL usually results in a program crash, but dereferencing an offset from NULL allows an exploit to succeed without crashing the program.

...

[DHS 2006]Handle All Errors Safely
[Henricson 1997]Recommendation 12.1, "Check for All Errors Reported from Functions"
[ISO/IEC 9899:20112024]Subclause 7.2123.7.10, "The ungetc Function"

...