SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 94

changes.mady.by.user Will Snavely

Saved on

compared with

New Version Current

changes.mady.by.user Jill Britton

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

This is a subtle error that results in a disturbingly broad range of potentially severe vulnerabilities. At the very least, this error can lead to unexpected numerical results on different platforms. Unexpected arithmetic values when applied to arrays or pointers can yield buffer overflows or other invalid memory access.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

INT07-C

Medium

Probable

Medium

P8

L2

Automated Detection

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V
 Supported, but no explicit checker

Supported indirectly via MISRA C:2012 rules 10.1, 10.3 and 10.4.
Axivion Bauhaus Suite

Include Page
Axivion Bauhaus Suite_V
Axivion Bauhaus Suite_V

CertC-INT07
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V
LANG.TYPE.IOTInappropriate operand type
Compass/ROSE

 

 



Can detect violations of this recommendation. In particular, it flags any instance of a variable of type char (without a signed or unsigned qualifier) that appears in an arithmetic expression

ECLAIR

Include Page
ECLAIR_V
ECLAIR_V

CC2.INT07

Fully implemented

Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C1292, C1293, C4401, C4421, C4431, C4441, C4451


Klocwork
Include Page
Klocwork_V
Klocwork_V
PORTING.SIGNED.CHAR
 

LDRA tool suite
Include Page
LDRA_V
LDRA_V

93 S, 96 S, 101 S, 329 S, 432 S, 458 S

Fully implemented

Parasoft C/C++test
Include Page
c:
Parasoft_V
c:
Parasoft_V
MISRA2004-6_{1,2}Fully implementedSplint Include PageSplint_VSplint_V

 

 

PRQA QA-C Include PagePRQA QA-C_vPRQA QA-C_v

1292, 1293, 4401, 4421, 4431, 4441, 4451

 

CERT_C-INT07-a
CERT_C-INT07-b

The plain char type shall be used only for the storage and use of character values
signed and unsigned char type shall be used only for the storage and use of numeric values

PC-lint Plus

Include Page
PC-lint Plus_V
PC-lint Plus_V

9112

Fully supported

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rec. INT07-C


Checks for use of plain char type for numeric value (rec. fully covered)

Splint
Include Page
Splint_V
Splint_V



RuleChecker

Include Page
RuleChecker_V
RuleChecker_V


Supported indirectly via MISRA C:2012 rules 10.1, 10.3 and 10.4.
Partially implemented
SonarQube C/C++ Plugin
Include Page
SonarQube C/C++ Plugin_V
SonarQube C/C++ Plugin_V
S820
 

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

SEI CERT C++ Coding StandardVOID INT07-CPP. Use only explicitly signed or unsigned char type for numeric values
ISO/IEC TR 24772:2013Bit Representations [STR]
MISRA C:2012Rule 10.1 (required)
Rule 10.3 (required)
Rule 10.4 (required)
MITRE CWECWE-682, Incorrect calculation

...


...