Broad Mapping: CERT

JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

If you access the manual through the hub's Web GUI, the functionality will not be suppressed because the hub is a web server.
Alternatively, your browser may allow you to explicitly disable the security setting that suppresses functionality. See the CodeSonar FAQ for more information.

CodeSonar^® 9.0p0 Hot Tips

CONFIDENTIAL

CodeSecure Inc

Broad Mapping: CERT

This table contains broad mappings between SEI CERT coding standard rule and recommendation identifiers and CodeSonar warning classes.

The close mappings from SEI CERT coding standards to CodeSonar warning classes are shown in CERT Checks.

CSV versions of these tables are provided in CERT-C-mapping-broad.csv, CERT-CPP-mapping-broad.csv, and CERT-Java-mapping-broad.csv.

C
C++
Java

CERT-C: SEI CERT C Coding Standard

This table is also available in CSV format: CERT-C-mapping-broad.csv.

CERT-C

Category

C Warning Classes

CERT-C:API00-C Functions should validate their parameters

Recommendation

closely mapped	Unchecked Parameter Dereference
also related	Buffer Overrun Integer Overflow of Allocation Size Null Pointer Dereference Tainted Buffer Access

CERT-C:API07-C Enforce type safety

Recommendation

closely mapped	Cast Alters Value Coercion Alters Value GlobalHandle on GMEM_FIXED Memory GlobalLock on GMEM_FIXED Memory GlobalUnlock on GMEM_FIXED Memory LocalHandle on LMEM_FIXED Memory LocalLock on LMEM_FIXED Memory LocalUnlock on LMEM_FIXED Memory Pool Mismatch Type Mismatch

CERT-C:ARR00-C Understand how arrays work

Recommendation

closely mapped	Array to Pointer Conversion on Temporary Object

CERT-C:ARR01-C Do not apply the sizeof operator to a pointer when taking the size of an array

Recommendation

closely mapped	sizeof Array Parameter

CERT-C:ARR30-C Do not form or use out-of-bounds pointers or array subscripts

Rule

closely mapped	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CERT-C:ARR32-C Ensure size arguments for variable length arrays are in a valid range

Rule

closely mapped	Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Unreasonable Size Argument
also related	Tainted Buffer Access

CERT-C:ARR36-C Do not subtract or compare two pointers that do not refer to the same array

Rule

closely mapped	Comparison of Unrelated Pointers Subtraction of Unrelated Pointers

CERT-C:ARR37-C Do not add or subtract an integer to a pointer to a non-array object

Rule

closely mapped	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CERT-C:ARR38-C Guarantee that library functions do not form invalid pointers

Rule

closely mapped	Buffer Overrun Buffer Underrun

CERT-C:ARR39-C Do not add or subtract a scaled integer to a pointer

Rule

closely mapped	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CERT-C:CON01-C Acquire and release synchronization primitives in the same module, at the same level of abstraction

Recommendation

closely mapped	Missing Lock Acquisition Missing Lock Release

CERT-C:CON02-C Do not use volatile as a synchronization primitive

Recommendation

closely mapped	Inappropriate Volatile Declaration

CERT-C:CON05-C Do not perform operations that can block while holding a lock

Recommendation

closely mapped	Blocking in Critical Section

CERT-C:CON06-C Ensure that every mutex outlives the data it protects

Recommendation

also related	Data Race Use After Free

CERT-C:CON07-C Ensure that compound operations on shared variables are atomic

Recommendation

closely mapped	Data Race
also related	Risky Atomic Memory Order

CERT-C:CON08-C Do not assume that a group of calls to independently atomic methods is atomic

Recommendation

also related	Risky Atomic Memory Order

CERT-C:CON30-C Clean up thread-specific storage

Rule

closely mapped	Leak

CERT-C:CON31-C Do not destroy a mutex while it is locked

Rule

closely mapped	Local Variable Passed to Thread

CERT-C:CON32-C Prevent data races when accessing bit-fields from multiple threads

Rule

closely mapped	Data Race Multiple Accesses of Atomic

CERT-C:CON33-C Avoid race conditions when using library functions

Rule

closely mapped	Use of rand Use of tmpnam Use of ttyname
also related	Use of setlocale

CERT-C:CON34-C Declare objects shared between threads with appropriate storage durations

Rule

closely mapped	Inappropriate Storage Duration Local Variable Passed to Thread

CERT-C:CON35-C Avoid deadlock by locking in a predefined order

Rule

closely mapped	Conflicting Lock Order

CERT-C:CON36-C Wrap functions that can spuriously wake up in a loop

Rule

closely mapped	Inappropriate Call Outside Loop Use of Condition Variable Wait

CERT-C:CON37-C Do not call signal() in a multithreaded program

Rule

closely mapped	Use of signal

CERT-C:CON38-C Preserve thread safety and liveness when using condition variables

Rule

closely mapped	Use of Condition Variable Signal

CERT-C:CON39-C Do not join or detach a thread that was previously joined or detached

Rule

closely mapped	Thread is not Joinable

CERT-C:CON40-C Do not refer to an atomic variable twice in an expression

Rule

closely mapped	Multiple Accesses of Atomic

CERT-C:CON41-C Wrap functions that can fail spuriously in a loop

Rule

closely mapped	Inappropriate Call Outside Loop

CERT-C:CON43-C Do not allow data races in multithreaded code

Rule

closely mapped	Data Race Multiple Accesses of Atomic

CERT-C:DCL00-C Const-qualify immutable objects

Recommendation

closely mapped	Cast Removes const Qualifier Returned Pointer Not Treated as const Variable Could Be const

CERT-C:DCL01-C Do not reuse variable names in subscopes

Recommendation

closely mapped	Non-distinct Identifiers: Nested Scope

CERT-C:DCL02-C Use visually distinct identifiers

Recommendation

closely mapped	Typographically Ambiguous Identifiers

CERT-C:DCL04-C Do not declare more than one variable per declaration

Recommendation

closely mapped	Multiple Declarations On Line

CERT-C:DCL05-C Use typedefs of non-pointer types only

Recommendation

closely mapped	Pointer Type Inside Typedef

CERT-C:DCL06-C Use meaningful symbolic constants to represent literal values

Recommendation

closely mapped	switch With Non-enum Expression

CERT-C:DCL07-C Include the appropriate type information in function declarators

Recommendation

closely mapped	Implicit Type Incomplete Function Prototype

CERT-C:DCL11-C Understand the type issues associated with variadic functions

Recommendation

closely mapped	Ellipsis

CERT-C:DCL13-C Declare function parameters that are pointers to values not changed by the function as const

Recommendation

closely mapped	Pointed-to Type Could Be const

CERT-C:DCL15-C Declare file-scope objects or functions that do not need external linkage as static

Recommendation

closely mapped	Scope Could Be File Static

CERT-C:DCL16-C Use "L," not "l," to indicate a long value

Recommendation

closely mapped	Confusing Literal Suffix

CERT-C:DCL17-C Beware of miscompiled volatile-qualified variables

Recommendation

also related	Inappropriate Volatile Declaration

CERT-C:DCL18-C Do not begin integer constants with 0 when specifying a decimal value

Recommendation

closely mapped	Octal Constant

CERT-C:DCL19-C Minimize the scope of variables and functions

Recommendation

closely mapped	Scope Could Be File Static Scope Could Be Local Static

CERT-C:DCL20-C Explicitly specify void when a function accepts no arguments

Recommendation

closely mapped	Incomplete Function Prototype

CERT-C:DCL23-C Guarantee that mutually visible identifiers are unique

Recommendation

closely mapped

CERT-C:DCL30-C Declare objects with appropriate storage durations

Rule

closely mapped	Return Pointer to Local

CERT-C:DCL36-C Do not declare an identifier with conflicting linkage classifications

Rule

closely mapped	Missing External Declaration

CERT-C:DCL37-C Do not declare or define a reserved identifier

Rule

closely mapped	Declaration of Reserved Name

CERT-C:DCL38-C Use the correct syntax when declaring a flexible array member

Rule

also related	Buffer Overrun Type Overrun

CERT-C:DCL39-C Avoid information leakage when passing a structure across a trust boundary

Rule

closely mapped	Padding Passed Across a Trust Boundary

CERT-C:DCL40-C Do not create incompatible declarations of the same function or object

Rule

closely mapped	Inconsistent Function Declarations Inconsistent Object Declarations
also related	Implicit Function Declaration

CERT-C:DCL41-C Do not declare variables inside a switch statement before the first case label

Rule

closely mapped	Malformed switch Statement

CERT-C:ENV01-C Do not make assumptions about the size of an environment variable

Recommendation

closely mapped	Buffer Overrun Type Overrun

CERT-C:ENV30-C Do not modify the object referenced by the return value of certain functions

Rule

closely mapped	Returned Pointer Not Treated as const Use of getenv
also related	Use of setlocale

CERT-C:ENV31-C Do not rely on an environment pointer following an operation that may invalidate it

Rule

also related	Use After Free

CERT-C:ENV32-C All exit handlers must return normally

Rule

closely mapped	Use of abort Use of exit Use of longjmp

CERT-C:ENV33-C Do not call system()

Rule

closely mapped	Command Injection Use of system

CERT-C:ENV34-C Do not store pointers returned by certain functions

Rule

also related	Use After Free

CERT-C:ERR30-C Take care when reading errno

Rule

closely mapped	Redundant Condition
also related	Ignored Return Value Inappropriate Test of Error Code Missing Test of Error Code Non-zero Error Code

CERT-C:ERR33-C Detect and handle standard library errors

Rule

closely mapped	Ignored Return Value Missing Test of Error Code Non-zero Error Code

CERT-C:ERR34-C Detect errors when converting a string to a number

Rule

closely mapped	Use of atof Use of atoi Use of atol Use of atoll

CERT-C:EXP00-C Use parentheses for precedence of operation

Recommendation

closely mapped	Missing Parentheses

CERT-C:EXP05-C Do not cast away a const qualification

Recommendation

closely mapped	Cast Removes const Qualifier

CERT-C:EXP08-C Ensure pointer arithmetic is used correctly

Recommendation

closely mapped	Buffer Overrun Buffer Underrun Comparison of Unrelated Pointers Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Subtraction of Unrelated Pointers Tainted Buffer Access Type Overrun Type Underrun

CERT-C:EXP10-C Do not depend on the order of evaluation of subexpressions or the order in which side effects take place

Recommendation

closely mapped	Indeterminate Order of Evaluation

CERT-C:EXP11-C Do not make assumptions regarding the layout of structures with bit-fields

Recommendation

also related	Bit-field in Union

CERT-C:EXP12-C Do not ignore values returned by functions

Recommendation

closely mapped	Ignored Return Value

CERT-C:EXP14-C Beware of integer promotion when performing bitwise operations on integer types smaller than int

Recommendation

closely mapped	Risky Integer Promotion

CERT-C:EXP15-C Do not place a semicolon on the same line as an if, for, or while statement

Recommendation

closely mapped	Empty Branch Statement Empty for Statement Empty if Statement Empty switch Statement Empty while Statement

CERT-C:EXP30-C Do not depend on the order of evaluation for side effects

Rule

closely mapped	Side Effects in Expression with Decrement Side Effects in Expression with Increment Side Effects in Initializer List
also related	Indeterminate Order of Evaluation

CERT-C:EXP33-C Do not read uninitialized memory

Rule

closely mapped	Uninitialized Variable
also related	Inappropriate C Atomic Initialization

CERT-C:EXP34-C Do not dereference null pointers

Rule

closely mapped	Null Pointer Dereference Null Test After Dereference Unchecked Parameter Dereference

CERT-C:EXP35-C Do not modify objects with temporary lifetime

Rule

closely mapped	Array to Pointer Conversion on Temporary Object

CERT-C:EXP36-C Do not cast pointers into more strictly aligned pointer types

Rule

closely mapped	Cast: Object Pointers

CERT-C:EXP37-C Call functions with the correct number and type of arguments

Rule

closely mapped	Array Parameter Mismatch

CERT-C:EXP39-C Do not access a variable through a pointer of an incompatible type

Rule

also related	Cast: Object Pointers Float Pointer Conversion

CERT-C:EXP40-C Do not modify constant objects

Rule

also related	Cast Removes const Qualifier

CERT-C:EXP42-C Do not compare padding data

Rule

closely mapped	Use of memcmp
also related	Inappropriate Argument to memcmp

CERT-C:EXP43-C Avoid undefined behavior when using restrict-qualified pointers

Rule

closely mapped	Restrict Qualifier Used

CERT-C:EXP44-C Do not rely on side effects in operands to sizeof, _Alignof, or _Generic

Rule

closely mapped	Side Effects in C Generic Selection Side Effects in sizeof

CERT-C:EXP45-C Do not perform assignments in selection statements

Rule

closely mapped	Assignment Result in Expression Assignment in Conditional Condition Contains Side Effects

CERT-C:EXP46-C Do not use a bitwise operator with a Boolean-like operand

Rule

closely mapped	Inappropriate Operand Type

CERT-C:EXP47-C Do not call va_arg with an argument of the incorrect type

Rule

closely mapped	Use of <stdarg.h> Feature

CERT-C:FIO01-C Be careful using functions that use file names for identification

Recommendation

closely mapped	File System Race Condition Tainted Filename Use of GetTempFileName Use of mkstemp Use of mktemp Use of tmpfile Use of tmpfile_s Use of tmpnam Use of tmpnam_s

CERT-C:FIO02-C Canonicalize path names originating from tainted sources

Recommendation

closely mapped	Tainted Filename

CERT-C:FIO03-C Do not make assumptions about fopen() and file creation

Recommendation

also related	Use of fopen_s

CERT-C:FIO06-C Create files with appropriate access permissions

Recommendation

closely mapped	Use of CreateFile

CERT-C:FIO11-C Take care when specifying the mode parameter of fopen()

Recommendation

also related	Use of fopen_s

CERT-C:FIO21-C Do not create temporary files in shared directories

Recommendation

closely mapped	Use of GetTempFileName Use of mktemp Use of tmpfile Use of tmpfile_s Use of tmpnam Use of tmpnam_s

CERT-C:FIO24-C Do not open a file that is already open

Recommendation

closely mapped	File Open for Both Read and Write File System Race Condition

CERT-C:FIO30-C Exclude user input from format strings

Rule

closely mapped	Format String Format String Injection

CERT-C:FIO34-C Distinguish between characters read from a file and EOF or WEOF

Rule

closely mapped	Coercion Alters Value

CERT-C:FIO37-C Do not assume that fgets() or fgetws() returns a nonempty string when successful

Rule

closely mapped	Buffer Underrun

CERT-C:FIO39-C Do not alternately input and output from a stream without an intervening flush or positioning call

Rule

closely mapped	Input After Output Without Positioning Output After Input Without Positioning

CERT-C:FIO40-C Reset strings on fgets() or fgetws() failure

Rule

closely mapped	Uninitialized Variable

CERT-C:FIO41-C Do not call getc(), putc(), getwc(), or putwc() with a stream argument that has side effects

Rule

also related	Leak

CERT-C:FIO42-C Close files when they are no longer needed

Rule

closely mapped	Leak

CERT-C:FIO45-C Avoid TOCTOU race conditions while accessing files

Rule

closely mapped	File System Race Condition

CERT-C:FIO46-C Do not access a closed file

Rule

closely mapped	Use After Close

CERT-C:FIO47-C Use valid format strings

Rule

closely mapped	Format String Format String Injection Format String Type Error

CERT-C:FLP00-C Understand the limitations of floating-point numbers

Recommendation

closely mapped	Float Multiplication Overflow Floating Point Equality

CERT-C:FLP02-C Avoid using floating-point numbers when precise computation is needed

Recommendation

closely mapped	Floating Point Equality

CERT-C:FLP06-C Convert integers to floating point for floating-point operations

Recommendation

closely mapped	Mismatched Operand Types

CERT-C:FLP30-C Do not use floating-point variables as loop counters

Rule

closely mapped	Float-typed Loop Counter

CERT-C:FLP32-C Prevent or detect domain and range errors in math functions

Rule

closely mapped	Arctangent Domain Error Argument Too High Argument Too Low Floating Point Domain Error Floating Point Range Error Gamma on Zero Logarithm on Negative Value Logarithm on Zero Raises FE_INVALID Undefined Power of Zero cosh on High Number cosh on Low Number sqrt on Negative Value

CERT-C:FLP34-C Ensure that floating-point conversions are within range of the new type

Rule

closely mapped	Inappropriate Assignment Type

CERT-C:FLP36-C Preserve precision when converting integral values to floating-point type

Rule

closely mapped	Inappropriate Assignment Type

CERT-C:FLP37-C Do not use object representations to compare floating-point values

Rule

also related	Inappropriate Argument to memcmp

CERT-C:INT01-C Use rsize_t or size_t for all integer values representing the size of an object

Recommendation

closely mapped	Basic Numerical Type Used

CERT-C:INT02-C Understand integer conversion rules

Recommendation

closely mapped	Cast Alters Value Coercion Alters Value Truncation of Allocation Size Truncation of Size
also related	Inappropriate Selection Type in C Generic

CERT-C:INT04-C Enforce limits on integer values originating from tainted sources

Recommendation

closely mapped	Tainted Allocation Size Tainted Buffer Access Tainted Network Address Untrusted Network Host Untrusted Network Port

CERT-C:INT05-C Do not use input functions to convert character data if they cannot handle all possible inputs

Recommendation

closely mapped	Negative Character Value

CERT-C:INT07-C Use only explicitly signed or unsigned char type for numeric values

Recommendation

closely mapped	Inappropriate Operand Type

CERT-C:INT08-C Verify that all integer values are in range

Recommendation

closely mapped	Addition Overflow of Allocation Size Addition Overflow of Size Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Multiplication Overflow of Size Subtraction Underflow of Allocation Size Subtraction Underflow of Size Unreasonable Size Argument

CERT-C:INT09-C Ensure enumeration constants map to unique values

Recommendation

closely mapped	Inconsistent Enumerator Initialization

CERT-C:INT12-C Do not make assumptions about the type of a plain int bit-field when used in an expression

Recommendation

closely mapped	Bit-field Signedness Not Explicit

CERT-C:INT13-C Use bitwise operators only on unsigned operands

Recommendation

closely mapped	Inappropriate Operand Type

CERT-C:INT18-C Evaluate integer expressions in a larger size before comparing or assigning to that size

Recommendation

closely mapped

CERT-C:INT30-C Ensure that unsigned integer operations do not wrap

Rule

closely mapped	Addition Overflow of Allocation Size Addition Overflow of Size Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Multiplication Overflow of Size Subtraction Underflow of Allocation Size Subtraction Underflow of Size Unreasonable Size Argument

CERT-C:INT31-C Ensure that integer conversions do not result in lost or misinterpreted data

Rule

closely mapped	Cast Alters Value Cast: Arithmetic Type/Void Pointer Coercion Alters Value Coercion: Integer Constant to Pointer Conversion: Pointer/Integer Tainted Buffer Access Truncation of Allocation Size Truncation of Size

CERT-C:INT32-C Ensure that operations on signed integers do not result in overflow

Rule

closely mapped	Addition Overflow of Allocation Size Addition Overflow of Size Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Multiplication Overflow of Size Subtraction Underflow of Allocation Size Subtraction Underflow of Size Unreasonable Size Argument

CERT-C:INT33-C Ensure that division and remainder operations do not result in divide-by-zero errors

Rule

closely mapped	Division By Zero Float Division By Zero

CERT-C:INT34-C Do not shift an expression by a negative number of bits or by greater than or equal to the number of bits that exist in the operand

Rule

closely mapped	Negative Shift Amount Shift Amount Exceeds Bit Width

CERT-C:INT35-C Use correct integer precisions

Rule

closely mapped	Shift Amount Exceeds Bit Width

CERT-C:INT36-C Converting a pointer to integer or integer to pointer

Rule

closely mapped	Coercion: Integer Constant to Pointer Conversion: Pointer/Integer

CERT-C:MEM00-C Allocate and free memory in the same module, at the same level of abstraction

Recommendation

closely mapped	Double Free Leak

CERT-C:MEM01-C Store a new value in pointers immediately after free()

Recommendation

closely mapped	Double Free Use After Free

CERT-C:MEM05-C Avoid large stack allocations

Recommendation

closely mapped	Tainted Allocation Size Unreasonable Size Argument

CERT-C:MEM07-C Ensure that the arguments to calloc(), when multiplied, do not wrap

Recommendation

closely mapped	Multiplication Overflow of Allocation Size

CERT-C:MEM11-C Do not assume infinite heap space

Recommendation

closely mapped	Leak Tainted Allocation Size Unreasonable Size Argument

CERT-C:MEM30-C Do not access freed memory

Rule

closely mapped	Use After Free

CERT-C:MEM31-C Free dynamically allocated memory when no longer needed

Rule

closely mapped	Leak

CERT-C:MEM33-C Allocate and copy structures containing a flexible array member dynamically

Rule

closely mapped	Declaration of Flexible Array Member
also related	Buffer Overrun Tainted Buffer Access

CERT-C:MEM34-C Only free memory allocated dynamically

Rule

closely mapped	Type Mismatch

CERT-C:MEM35-C Allocate sufficient memory for an object

Rule

closely mapped

CERT-C:MEM36-C Do not modify the alignment of objects by calling realloc()

Rule

closely mapped	Use of realloc

CERT-C:MSC00-C Compile cleanly at high warning levels

Recommendation

closely mapped	Not All Warnings Are Enabled Warnings Not Treated As Errors

CERT-C:MSC06-C Beware of compiler optimizations

Recommendation

closely mapped	Use of memset

CERT-C:MSC07-C Detect and remove dead code

Recommendation

closely mapped	Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow

CERT-C:MSC11-C Incorporate diagnostic tests using assertions

Recommendation

closely mapped	Not Enough Assertions

CERT-C:MSC12-C Detect and remove code that has no effect or is never executed

Recommendation

closely mapped

CERT-C:MSC13-C Detect and remove unused values

Recommendation

closely mapped	Unused Value

CERT-C:MSC15-C Do not depend on undefined behavior

Recommendation

also related	Array to Pointer Conversion on Temporary Object

CERT-C:MSC17-C Finish every set of statements associated with a case label with a break statement

Recommendation

closely mapped	Missing break

CERT-C:MSC18-C Be careful while handling sensitive data, such as passwords, in program code

Recommendation

closely mapped	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password Plaintext Transmission of Password

CERT-C:MSC20-C Do not use a switch statement to transfer control into a complex block

Recommendation

closely mapped	Misplaced case

CERT-C:MSC21-C Use robust loop termination conditions

Recommendation

closely mapped	High Risk Loop Potential Unbounded Loop

CERT-C:MSC22-C Use the setjmp(), longjmp() facility securely

Recommendation

closely mapped	Use of longjmp Use of setjmp

CERT-C:MSC23-C Beware of vendor-specific library and language differences

Recommendation

closely mapped

CERT-C:MSC24-C Do not use deprecated or obsolescent functions

Recommendation

closely mapped	Use of LoadModule Use of MoveFile Use of WinExec Use of cuserid Use of drem Use of gamma

CERT-C:MSC25-C Do not use insecure or weak cryptographic algorithms

Recommendation

closely mapped	Use of Weak Cryptographic Algorithm Weak Cryptography

CERT-C:MSC30-C Do not use the rand() function for generating pseudorandom numbers

Rule

closely mapped	Use of rand

CERT-C:MSC32-C Properly seed pseudorandom number generators

Rule

closely mapped	Hardcoded Seed in PRNG Predictable Seed in PRNG

CERT-C:MSC33-C Do not pass invalid data to the asctime() function

Rule

closely mapped	Use of <time.h> Time/Date Function

CERT-C:MSC37-C Ensure that control never reaches the end of a non-void function

Rule

closely mapped	Missing Return Statement

CERT-C:MSC38-C Do not treat a predefined identifier as an object if it might only be implemented as a macro

Rule

closely mapped	Use of <stdarg.h> Feature

CERT-C:MSC39-C Do not call va_arg() on a va_list that has an indeterminate value

Rule

closely mapped	Use of <stdarg.h> Feature

CERT-C:MSC41-C Never hard code sensitive information

Rule

closely mapped	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Hardcoded Seed in PRNG

CERT-C:POS05-C Limit access to files by creating a jail

Recommendation

closely mapped	Use of chroot chroot without chdir

CERT-C:POS30-C Use the readlink() function properly

Rule

closely mapped	Buffer Overrun Tainted Buffer Access Unterminated C String

CERT-C:POS34-C Do not call putenv() with a pointer to an automatic variable as the argument

Rule

closely mapped	Use of putenv

CERT-C:POS38-C Beware of race conditions when using fork and file descriptors

Rule

closely mapped	Use of fork

CERT-C:POS44-C Do not use signals to terminate threads

Rule

closely mapped	Use of pthread_kill

CERT-C:POS48-C Do not unlock or destroy another POSIX thread's mutex

Rule

closely mapped	Double Unlock

CERT-C:POS49-C When data must be accessed by multiple threads, provide a mutex and guarantee no adjacent data is also accessed

Rule

closely mapped	Data Race Multiple Accesses of Atomic

CERT-C:POS51-C Avoid deadlock with POSIX threads by locking in predefined order

Rule

closely mapped	Conflicting Lock Order

CERT-C:POS52-C Do not perform operations that can block while holding a POSIX lock

Rule

closely mapped	Blocking in Critical Section

CERT-C:POS54-C Detect and handle POSIX library errors

Rule

closely mapped	Ignored Return Value Missing Test of Error Code Non-zero Error Code

CERT-C:PRE00-C Prefer inline or static functions to function-like macros

Recommendation

closely mapped	Function-Like Macro

CERT-C:PRE02-C Macro replacement lists should be parenthesized

Recommendation

closely mapped	Macro Does Not End With } or ) Macro Does Not Start With { or (

CERT-C:PRE05-C Understand macro replacement when concatenating tokens or performing stringification

Recommendation

closely mapped	Macro Argument is both Mixed and Expanded Macro Uses # Operator Macro Uses ## Operator

CERT-C:PRE11-C Do not conclude macro definitions with a semicolon

Recommendation

closely mapped	Macro Does Not End With } or )

CERT-C:PRE30-C Do not create a universal character name through concatenation

Rule

closely mapped	## Follows # Operator Macro Uses ## Operator

CERT-C:PRE31-C Avoid side effects in arguments to unsafe macros

Rule

closely mapped	Function-Like Macro Side Effects in Expression with Decrement Side Effects in Expression with Increment
also related	Excessive Macro Parameter Evaluation in C Generic Inconsistent Macro Parameter Expansion in C Generic Too Many Side Effects in Assignment Too Many Side Effects in Condition Too Many Side Effects in Function Call Too Many Side Effects in Statement Too Many Side Effects in Switch

CERT-C:PRE32-C Do not use preprocessor directives in invocations of function-like macros

Rule

closely mapped	Preprocessing Directives in Macro Argument

CERT-C:SIG00-C Mask signals handled by noninterruptible signal handlers

Recommendation

closely mapped	Use of signal

CERT-C:SIG01-C Understand implementation-specific details regarding signal handler persistence

Recommendation

closely mapped	Use of signal

CERT-C:SIG02-C Avoid using signals to implement normal functionality

Recommendation

closely mapped	Use of signal

CERT-C:SIG30-C Call only asynchronous-safe functions within signal handlers

Rule

closely mapped	Use of signal

CERT-C:SIG31-C Do not access shared objects in signal handlers

Rule

closely mapped	Data Race

CERT-C:SIG34-C Do not call signal() from within interruptible signal handlers

Rule

closely mapped	Use of signal

CERT-C:SIG35-C Do not return from a computational exception signal handler

Rule

closely mapped	Return from Computational Exception Signal Handler

CERT-C:STR00-C Represent characters using an appropriate type

Recommendation

closely mapped	Negative Character Value

CERT-C:STR02-C Sanitize data passed to complex subsystems

Recommendation

closely mapped	Command Injection Format String Injection LDAP Injection Library Injection SQL Injection Untrusted Library Load Untrusted Process Creation

CERT-C:STR03-C Do not inadvertently truncate a string

Recommendation

closely mapped	No Space For Null Terminator

CERT-C:STR04-C Use plain char for characters in the basic character set

Recommendation

closely mapped	Inappropriate Assignment Type Inappropriate Character Arithmetic Inappropriate Operand Type Mismatched Operand Types

CERT-C:STR05-C Use pointers to const when referring to string literals

Recommendation

closely mapped	Non-const String Literal

CERT-C:STR07-C Use the bounds-checking interfaces for string manipulation

Recommendation

closely mapped	Use of OemToAnsi Use of OemToChar Use of StrCatChainW Use of strcat Use of strchr Use of strcmp Use of strcoll Use of strcpy Use of strcspn Use of strlen Use of strpbrk Use of strrchr Use of strspn Use of strstr Use of strtok Use of strtrns

CERT-C:STR30-C Do not attempt to modify string literals

Rule

also related	Cast Removes const Qualifier Non-const String Literal

CERT-C:STR31-C Guarantee that storage for strings has sufficient space for character data and the null terminator

Rule

closely mapped	Buffer Overrun No Space For Null Terminator Type Overrun

CERT-C:STR32-C Do not pass a non-null-terminated character sequence to a library function that expects a string

Rule

closely mapped	Unterminated C String

CERT-C:STR34-C Cast characters to unsigned char before converting to larger integer sizes

Rule

closely mapped	Negative Character Value

CERT-C:STR37-C Arguments to character-handling functions must be representable as an unsigned char

Rule

closely mapped	Negative Character Value

CERT-C:STR38-C Do not confuse narrow and wide character strings and functions

Rule

closely mapped	Buffer Overrun Tainted Buffer Access

CERT-C:WIN00-C Be specific when dynamically loading libraries

Recommendation

closely mapped	Use of AfxLoadLibrary Use of CoLoadLibrary Use of LoadLibrary

CERT-C:WIN02-C Restrict privileges when spawning child processes

Recommendation

closely mapped	Use of CreateProcess

CERT-C:WIN30-C Properly pair allocation and deallocation functions

Rule

closely mapped	Pool Mismatch Type Mismatch

CERT-CPP: SEI CERT C++ Coding Standard

This table is also available in CSV format: CERT-CPP-mapping-broad.csv.

CERT-CPP

SEI CERT Oracle Coding Standard for Java

This table is also available in CSV format: CERT-Java-mapping-broad.csv.

CERT-Java