Secure C coding standards by SEI
securecoding.cert.org
Secure C coding standards by SEI
1–10 of 19 posts
Re: Secure C coding standards by SEI
#2Is there a code analysis tool that will flag code that violates these rules?
Re: Secure C coding standards by SEI
#3Is there a code analysis tool that will flag code that violates these rules?
Elsewhere on the SEI site there are some checkers [1] [2]. They also advocate using clang's "-Wthread-safety" among others. It doesn't sound to me like there exists a tool that will measure this coding standard as conformance criteria.
Re: Secure C coding standards by SEI
#4Is there a code analysis tool that will flag code that violates these rules?
[deleted]
Re: Secure C coding standards by SEI
#5Direct PDF download:
http://www.sei.cmu.edu/downloads/sei-cert-c-coding-standard-...
Re: Secure C coding standards by SEI
#6Is there a code analysis tool that will flag code that violates these rules?
Clang tidy supports some of the rules http://clang.llvm.org/extra/clang-tidy/
Re: Secure C coding standards by SEI
#7The “compliant solution” example for setlocale() is thread-unsafe, AFAICT.
(I’m not aware of a safe solution other than “don’t use the text processing part of the C standard library, because its design is too wrong”.)
Re: Secure C coding standards by SEI
#8Direct PDF download: http://www.sei.cmu.edu/downloads/sei-cert-c-coding-standard-...
Miserable fail to cert for requiring a https-less registration for a document on security.
Re: Secure C coding standards by SEI
#9Direct PDF download: http://www.sei.cmu.edu/downloads/sei-cert-c-coding-standard-...
Miserable fail to cert for requiring a https-less registration for a document on security.
CMU doesn't require, but it does allow:
https://www.sei.cmu.edu/downloads/sei-cert-c-coding-standard...
Re: Secure C coding standards by SEI
#10Is anyone else finding some of these rules to be bizzarely tone deaf?
Recurring pattern:
"Don't do such and such that is obviously wrong."
Well, no kidding! I would never do such a thing ... on purpose! It's the not-on-purpose occurrences that I need help with.
Without a concrete plan on how to prevent or detect that situation, this advice isn't helpful. I know I shouldn't rely on uninitialized memory, and, believe me, I do not want to. Give me a coding strategy which minimizes the occurrence of uses of uninitialized memory. Recommend a compiler and its particular compiler options, or some lint or other static checking tool or run-time detection.
"Don't read uninitialized memory" isn't something I can turn into a concrete action to somehow improve software quality.
It's like a driver's manual which says "stay on the road and don't run over people".