CERT C Secure Coding Standard (2008) Chapter 7 - Arrays (ARR)

Opis

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).

Wpisy w tej grupie

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
• CWE-129 Improper Validation of Array Index
• CWE-467 Use of sizeof() on a Pointer Type
• CWE-469 Use of Pointer Subtraction to Determine Size
• CWE-665 Improper Initialization
• CWE-805 Buffer Access with Incorrect Length Value

Uwagi

<xhtml:p>In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:</xhtml:p> <xhtml:ul> <xhtml:li>CWE-119 ARR00-C Understand how arrays work</xhtml:li> <xhtml:li>CWE-119 ARR33-C Guarantee that copies are made into storage of sufficient size</xhtml:li> <xhtml:li>CWE-119 ARR34-C Ensure that array types in expressions are compatible</xhtml:li> <xhtml:li>CWE-119 ARR35-C Do not allow loops to iterate beyond the end of an array</xhtml:li> <xhtml:li>CWE-129 ARR00-C Understand how arrays work</xhtml:li> <xhtml:li>CWE-129 ARR30-C Guarantee that array indices are within the valid range</xhtml:li> <xhtml:li>CWE-129 ARR38-C Do not add or subtract an integer to a pointer if the resulting value does not refer to a valid array element</xhtml:li> <xhtml:li>CWE-467 ARR01-C Do not apply the sizeof operator to a pointer when taking the size of an array</xhtml:li> <xhtml:li>CWE-469 ARR36-C Do not subtract or compare two pointers that do not refer to the same array</xhtml:li> <xhtml:li>CWE-469 ARR37-C Do not add or subtract an integer to a pointer to a non-array object</xhtml:li> <xhtml:li>CWE-665 ARR02-C Explicitly specify array bounds, even if implicitly defined by an initializer</xhtml:li> <xhtml:li>CWE-805 ARR33-C Guarantee that copies are made into storage of sufficient size</xhtml:li> </xhtml:ul>

Źródła