CERT C Secure Coding Standard (2008) Chapter 9 - Memory Management (MEM)

Opis

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

Wpisy w tej grupie

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
• CWE-128 Wrap-around Error
• CWE-131 Incorrect Calculation of Buffer Size
• CWE-190 Integer Overflow or Wraparound
• CWE-20 Improper Input Validation
• CWE-226 Sensitive Information in Resource Not Removed Before Reuse
• CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection')
• CWE-252 Unchecked Return Value
• CWE-415 Double Free
• CWE-416 Use After Free
• CWE-476 NULL Pointer Dereference
• CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere
• CWE-590 Free of Memory not on the Heap
• CWE-591 Sensitive Data Storage in Improperly Locked Memory
• CWE-628 Function Call with Incorrectly Specified Arguments
• CWE-665 Improper Initialization
• CWE-687 Function Call With Incorrectly Specified Argument Value
• CWE-754 Improper Check for Unusual or Exceptional Conditions

Uwagi

<xhtml:p>In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:</xhtml:p> <xhtml:ul> <xhtml:li>CWE-20 MEM10-C Define and use a pointer validation function</xhtml:li> <xhtml:li>CWE-119 MEM09-C Do not assume memory allocation routines initialize memory</xhtml:li> <xhtml:li>CWE-128 MEM07-C Ensure that the arguments to calloc(), when multiplied, can be represented as a size_t</xhtml:li> <xhtml:li>CWE-131 MEM35-C Allocate sufficient memory for an object</xhtml:li> <xhtml:li>CWE-190 MEM07-C Ensure that the arguments to calloc(), when multiplied, can be represented as a size_t</xhtml:li> <xhtml:li>CWE-190 MEM35-C Allocate sufficient memory for an object</xhtml:li> <xhtml:li>CWE-226 MEM03-C Clear sensitive information stored in reusable resources returned for reuse</xhtml:li> <xhtml:li>CWE-244 MEM03-C Clear sensitive information stored in reusable resources returned for reuse</xhtml:li> <xhtml:li>CWE-252 MEM32-C Detect and handle memory allocation errors</xhtml:li> <xhtml:li>CWE-415 MEM00-C Allocate and free memory in the same module, at the same level of abstraction</xhtml:li> <xhtml:li>CWE-415 MEM01-C Store a new value in pointers immediately after free()</xhtml:li> <xhtml:li>CWE-415 MEM31-C Free dynamically allocated memory exactly once</xhtml:li> <xhtml:li>CWE-416 MEM00-C Allocate and free memory in the same module, at the same level of abstraction</xhtml:li> <xhtml:li>CWE-416 MEM01-C Store a new value in pointers immediately after free()</xhtml:li> <xhtml:li>CWE-416 MEM30-C Do not access freed memory</xhtml:li> <xhtml:li>CWE-476 MEM32-C Detect and handle memory allocation errors</xhtml:li> <xhtml:li>CWE-528 MEM06-C Ensure that sensitive data is not written out to disk</xhtml:li> <xhtml:li>CWE-590 MEM34-C Only free memory allocated dynamically</xhtml:li> <xhtml:li>CWE-591 MEM06-C Ensure that sensitive data is not written out to disk</xhtml:li> <xhtml:li>CWE-628 MEM08-C Use realloc() only to resize dynamically allocated arrays</xhtml:li> <xhtml:li>CWE-665 MEM09-C Do not assume memory allocation routines initialize memory</xhtml:li> <xhtml:li>CWE-687 MEM04-C Do not perform zero length allocations</xhtml:li> <xhtml:li>CWE-754 MEM32-C Detect and handle memory allocation errors</xhtml:li> </xhtml:ul>

Źródła