...
| Code Block | ||||
|---|---|---|---|---|
| ||||
void incr(int *intptr) {
if (intptr == NULL) {
/* Handle error */
}
(*intptr)++;
}
|
Compliant Solution
This incr() function can be improved by using the valid() function. The resulting implementation is less likely to dereference an invalid pointer or write to memory that is outside the bounds of a valid object.
| Code Block | ||||
|---|---|---|---|---|
| ||||
void incr(int *intptr) {
if (!valid(intptr)) {
/* Handle error */
}
(*intptr)++;
}
|
The valid() function can be implementation dependent and perform additional, platform-dependent checks when possible. In the worst case, the valid() function may only perform the same null-pointer check as the noncompliant code example. However, on platforms where additional pointer validation is possible, the use of a valid() function can provide checks.
...
A pointer validation function can be used to detect and prevent operations from being performed on some invalid pointers.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MEM10-C | High | Unlikely | High | P3 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| LDRA tool suite |
| 159 S | Enhanced enforcement |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| SEI CERT C++ Coding Standard | VOID MEM10-CPP. Define and use a pointer validation function |
| MITRE CWE | CWE-20, Improper Input Validation |
Bibliography
...
...