2345
Summary
Weaknesses in this category are related to the rules and recommendations in the Characters and
Strings (STR) chapter of the CERT C Secure Coding Standard (2008).
Membership
Nature Type ID Name Page
MemberOf 734 Weaknesses Addressed by the CERT C Secure Coding
Standard (2008)
734 2560
HasMember 78 Improper Neutralization of Special Elements used in an
OS Command ('OS Command Injection')
734 151
HasMember 88 Improper Neutralization of Argument Delimiters in a
Command ('Argument Injection')
734 194
HasMember 119 Improper Restriction of Operations within the Bounds of
a Memory Buffer
734 293
HasMember 120 Buffer Copy without Checking Size of Input ('Classic
Buffer Overflow')
734 304
HasMember 135 Incorrect Calculation of Multi-Byte String Length 734 370
HasMember 170 Improper Null Termination 734 428
HasMember 193 Off-by-one Error 734 486
HasMember 464 Addition of Data Structure Sentinel 734 1107
HasMember 686 Function Call With Incorrect Argument Type 734 1508
HasMember 704 Incorrect Type Conversion or Cast 734 1538
Notes
Relationship
In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped
to the following CWE IDs: CWE-78 STR02-C Sanitize data passed to complex subsystems
CWE-88 STR02-C Sanitize data passed to complex subsystems CWE-119 STR31-C Guarantee
that storage for strings has sufficient space for character data and the null terminator CWE-119
STR32-C Null-terminate byte strings as required CWE-119 STR33-C Size wide character strings
correctly CWE-120 STR35-C Do not copy data from an unbounded source to a fixed-length
array CWE-135 STR33-C Size wide character strings correctly CWE-170 STR03-C Do not
inadvertently truncate a null-terminated byte string CWE-170 STR32-C Null-terminate byte
strings as required CWE-193 STR31-C Guarantee that storage for strings has sufficient space
for character data and the null terminator CWE-464 STR03-C Do not inadvertently truncate a
null-terminated byte string CWE-464 STR06-C Do not assume that strtok() leaves the parse
string unchanged CWE-686 STR37-C Arguments to character handling functions must be
representable as an unsigned char CWE-704 STR34-C Cast characters to unsigned types before
converting to larger integer sizes CWE-704 STR37-C Arguments to character handling functions
must be representable as an unsigned char
References
[REF-597]Robert C. Seacord. "The CERT C Secure Coding Standard". 1st Edition. 2008 October
4. Addison-Wesley Professional.
Category-742: CERT C Secure Coding Standard (2008) Chapter 9 - Memory
Management (MEM)
Category ID : 742
Summary
CWE Version 4.14
CWE-742: CERT C Secure Coding Standard (2008) Chapter 9 - Memory Management (MEM)
CWE-742: CERT C Secure Coding Standard
(2008) Chapter 9 - Memory Management (MEM) 2346
Weaknesses in this category are related to the rules and recommendations in the Memory
Management (MEM) chapter of the CERT C Secure Coding Standard (2008).
Membership
Nature Type ID Name Page
MemberOf 734 Weaknesses Addressed by the CERT C Secure Coding
Standard (2008)
734 2560
HasMember 20 Improper Input Validation 734 20
HasMember 119 Improper Restriction of Operations within the Bounds of
a Memory Buffer
734 293
HasMember 128 Wrap-around Error 734 339
HasMember 131 Incorrect Calculation of Buffer Size 734 355
HasMember 190 Integer Overflow or Wraparound 734 472
HasMember 226 Sensitive Information in Resource Not Removed Before
Reuse
734 562
HasMember 244 Improper Clearing of Heap Memory Before Release
('Heap Inspection')
734 591
HasMember 252 Unchecked Return Value 734 606
HasMember 415 Double Free 734 1008
HasMember 416 Use After Free 734 1012
HasMember 476 NULL Pointer Dereference 734 1132
HasMember 528 Exposure of Core Dump File to an Unauthorized Control
Sphere
734 1237
HasMember 590 Free of Memory not on the Heap 734 1326
HasMember 591 Sensitive Data Storage in Improperly Locked Memory 734 1329
HasMember 628 Function Call with Incorrectly Specified Arguments 734 1398
HasMember 665 Improper Initialization 734 1456
HasMember 687 Function Call With Incorrectly Specified Argument Value 734 1510
HasMember 754 Improper Check for Unusual or Exceptional Conditions 734 1568
Notes
Relationship
In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped
to the following CWE IDs: CWE-20 MEM10-C Define and use a pointer validation function
CWE-119 MEM09-C Do not assume memory allocation routines initialize memory CWE-128
MEM07-C Ensure that the arguments to calloc(), when multiplied, can be represented as a size_t
CWE-131 MEM35-C Allocate sufficient memory for an object CWE-190 MEM07-C Ensure that
the arguments to calloc(), when multiplied, can be represented as a size_t CWE-190 MEM35-
C Allocate sufficient memory for an object CWE-226 MEM03-C Clear sensitive information
stored in reusable resources returned for reuse CWE-244 MEM03-C Clear sensitive information
stored in reusable resources returned for reuse CWE-252 MEM32-C Detect and handle memory
allocation errors CWE-415 MEM00-C Allocate and free memory in the same module, at the
same level of abstraction CWE-415 MEM01-C Store a new value in pointers immediately after
free() CWE-415 MEM31-C Free dynamically allocated memory exactly once CWE-416 MEM00-
C Allocate and free memory in the same module, at the same level of abstraction CWE-416
MEM01-C Store a new value in pointers immediately after free() CWE-416 MEM30-C Do
not access freed memory CWE-476 MEM32-C Detect and handle memory allocation errors
CWE-528 MEM06-C Ensure that sensitive data is not written out to disk CWE-590 MEM34-C
Only free memory allocated dynamically CWE-591 MEM06-C Ensure that sensitive data is not
written out to disk CWE-628 MEM08-C Use realloc() only to resize dynamically allocated arrays
CWE-665 MEM09-C Do not assume memory allocation routines initialize memory CWE-687
MEM04-C Do not perform zero length allocations CWE-754 MEM32-C Detect and handle
memory allocation errors
CWE Version 4.14
CWE-743: CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO)
CWE-743: CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO)