...
Code Block | ||||
---|---|---|---|---|
| ||||
constraint_handler_t handle_errors(void) { constraint_handler_t data; /* Define what to do when error occurs */ return data; } /* ... */ set_constraint_handler(handle_errors); /* ... */ /* Returns zero on success */ errno_t function(char *dst1, size_t dst_size) { char src1[100] = "hello"; strcpy_s(dst1, sizeof(dst1)dst_size, src1); /* * At this point strcpy_s may have yielded an * error, and handle_errors() might have returned. */ /* ... */ return 0; } |
...
Code Block | ||||
---|---|---|---|---|
| ||||
/* * The abort_handler_s() function writes * a message on the standard error stream and * then calls the abort() function. */ set_constraint_handler(abort_handler_s); /* ... */ /* Returns zero on success */ errno_t function(char *dst1, size_t dst_size) { char src1[100] = "hello"; strcpy_s(dst1, sizeof(dst1)dst_size, src1); /* * Because abort_handler_s() never returns, * we get here only if strcpy_s() succeeds. */ /* ... */ return 0; } |
...
The risk in using in-band error indicators is difficult to quantify and is consequently given as low. However, if the use of in-band error indicators results in programmers' failing to check status codes or incorrectly checking them, the consequences can be more severe.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
ERR02-C | Low | Unlikely | High | P1 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
---|---|---|---|---|---|---|---|---|---|
Parasoft C/C++test |
| CERT_C-ERR02-a | The input/output functions from the 'cstdio' and 'cwchar' libraries should not be used |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Bibliography
[Burch 2006] |
[ISO/IEC 9899:2011] | Subclause 6.3.2, "Other Operands" |
...
...