CERT C Secure Coding Standard (2008) Chapter 5 - Integers (INT)

Opis

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

Wpisy w tej grupie

• CWE-129 Improper Validation of Array Index
• CWE-190 Integer Overflow or Wraparound
• CWE-192 Integer Coercion Error
• CWE-197 Numeric Truncation Error
• CWE-20 Improper Input Validation
• CWE-369 Divide By Zero
• CWE-466 Return of Pointer Value Outside of Expected Range
• CWE-587 Assignment of a Fixed Address to a Pointer
• CWE-606 Unchecked Input for Loop Condition
• CWE-676 Use of Potentially Dangerous Function
• CWE-681 Incorrect Conversion between Numeric Types
• CWE-682 Incorrect Calculation

Uwagi

<xhtml:p>In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:</xhtml:p> <xhtml:ul> <xhtml:li>CWE-20 INT06-C Use strtol() or a related function to convert a string token to an integer</xhtml:li> <xhtml:li>CWE-129 INT32-C Ensure that operations on signed integers do not result in overflow</xhtml:li> <xhtml:li>CWE-190 INT03-C Use a secure integer library</xhtml:li> <xhtml:li>CWE-190 INT30-C Ensure that unsigned integer operations do not wrap</xhtml:li> <xhtml:li>CWE-190 INT32-C Ensure that operations on signed integers do not result in overflow</xhtml:li> <xhtml:li>CWE-190 INT35-C Evaluate integer expressions in a larger size before comparing or assigning to that size</xhtml:li> <xhtml:li>CWE-192 INT02-C Understand integer conversion rules</xhtml:li> <xhtml:li>CWE-192 INT05-C Do not use input functions to convert character data if they cannot handle all possible inputs</xhtml:li> <xhtml:li>CWE-192 INT31-C Ensure that integer conversions do not result in lost or misinterpreted data</xhtml:li> <xhtml:li>CWE-197 INT02-C Understand integer conversion rules</xhtml:li> <xhtml:li>CWE-197 INT05-C Do not use input functions to convert character data if they cannot handle all possible inputs</xhtml:li> <xhtml:li>CWE-197 INT31-C Ensure that integer conversions do not result in lost or misinterpreted data</xhtml:li> <xhtml:li>CWE-369 INT33-C Ensure that division and modulo operations do not result in divide-by-zero errors</xhtml:li> <xhtml:li>CWE-466 INT11-C Take care when converting from pointer to integer or integer to pointer</xhtml:li> <xhtml:li>CWE-587 INT11-C Take care when converting from pointer to integer or integer to pointer</xhtml:li> <xhtml:li>CWE-606 INT03-C Use a secure integer library</xhtml:li> <xhtml:li>CWE-676 INT06-C Use strtol() or a related function to convert a string token to an integer</xhtml:li> <xhtml:li>CWE-681 INT15-C Use intmax_t or uintmax_t for formatted IO on programmer-defined integer types</xhtml:li> <xhtml:li>CWE-681 INT31-C Ensure that integer conversions do not result in lost or misinterpreted data</xhtml:li> <xhtml:li>CWE-681 INT35-C Evaluate integer expressions in a larger size before comparing or assigning to that size</xhtml:li> <xhtml:li>CWE-682 INT07-C Use only explicitly signed or unsigned char type for numeric values</xhtml:li> <xhtml:li>CWE-682 INT13-C Use bitwise operators only on unsigned operands</xhtml:li> </xhtml:ul>

Źródła