CERT C Secure Coding Standard (2008) Chapter 8 - Characters and Strings (STR)

Opis

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

Wpisy w tej grupie

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
• CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CWE-135 Incorrect Calculation of Multi-Byte String Length
• CWE-170 Improper Null Termination
• CWE-193 Off-by-one Error
• CWE-464 Addition of Data Structure Sentinel
• CWE-686 Function Call With Incorrect Argument Type
• CWE-704 Incorrect Type Conversion or Cast
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Uwagi

<xhtml:p>In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:</xhtml:p> <xhtml:ul> <xhtml:li>CWE-78 STR02-C Sanitize data passed to complex subsystems</xhtml:li> <xhtml:li>CWE-88 STR02-C Sanitize data passed to complex subsystems</xhtml:li> <xhtml:li>CWE-119 STR31-C Guarantee that storage for strings has sufficient space for character data and the null terminator</xhtml:li> <xhtml:li>CWE-119 STR32-C Null-terminate byte strings as required</xhtml:li> <xhtml:li>CWE-119 STR33-C Size wide character strings correctly</xhtml:li> <xhtml:li>CWE-120 STR35-C Do not copy data from an unbounded source to a fixed-length array</xhtml:li> <xhtml:li>CWE-135 STR33-C Size wide character strings correctly</xhtml:li> <xhtml:li>CWE-170 STR03-C Do not inadvertently truncate a null-terminated byte string</xhtml:li> <xhtml:li>CWE-170 STR32-C Null-terminate byte strings as required</xhtml:li> <xhtml:li>CWE-193 STR31-C Guarantee that storage for strings has sufficient space for character data and the null terminator</xhtml:li> <xhtml:li>CWE-464 STR03-C Do not inadvertently truncate a null-terminated byte string</xhtml:li> <xhtml:li>CWE-464 STR06-C Do not assume that strtok() leaves the parse string unchanged</xhtml:li> <xhtml:li>CWE-686 STR37-C Arguments to character handling functions must be representable as an unsigned char</xhtml:li> <xhtml:li>CWE-704 STR34-C Cast characters to unsigned types before converting to larger integer sizes</xhtml:li> <xhtml:li>CWE-704 STR37-C Arguments to character handling functions must be representable as an unsigned char</xhtml:li> </xhtml:ul>

Źródła