MADCAD.com - The Cloud-Based Reference Library

eLibrary > PD ISO/IEC TR 24772:2013 Information technology. Programming languages. Guidance to avoiding vulnerabilities in programming languages through language selection and use >

PD ISO/IEC TR 24772:2013 Information technology. Programming languages. Guidance to avoiding vulnerabilities in programming languages through language selection and use, 2013

30281321-VOR.pdf [Go to Page]
Foreword
Introduction
1. Scope
2. Normative references
3. Terms and definitions, symbols and conventions [Go to Page]
3.1 Terms and definitions [Go to Page]
3.1.1 Communication
3.1.2 Execution model
3.1.3 Properties
3.1.4 Safety
3.1.5 Vulnerabilities
3.2 Symbols and conventions [Go to Page]
3.2.1 Symbols
3.2.2 Conventions
4. Basic concepts [Go to Page]
4.1 Purpose of this Technical Report
4.2 Intended audience
4.3 How to use this document
5 Vulnerability issues [Go to Page]
5.1 Predictable execution
5.2 Sources of unpredictability in language specification
5.2.1 Incomplete or evolving specification
5.2.2 Undefined behaviour
5.2.3 Unspecified behaviour
5.2.4 Implementation-defined behaviour
5.2.5 Difficult features
5.2.6 Inadequate language support
5.3 Sources of unpredictability in language usage
5.3.1 Porting and interoperation
5.3.2 Compiler selection and usage
6. Programming Language Vulnerabilities [Go to Page]
6.1 General
6.2 Terminology
6.3 Type System [IHN] [Go to Page]
6.3.1 Description of application vulnerability
6.3.2 Cross reference
6.3.3 Mechanism of failure
6.3.4 Applicable language characteristics
6.3.5 Avoiding the vulnerability or mitigating its effects
6.3.6 Implications for standardization
6.4 Bit Representations [STR] [Go to Page]
6.4.1 Description of application vulnerability
6.4.2 Cross reference
6.4.3 Mechanism of failure
6.4.4 Applicable language characteristics
6.4.5 Avoiding the vulnerability or mitigating its effects
6.4.6 Implications for standardization
6.5 Floating-point Arithmetic [PLF] [Go to Page]
6.5.1 Description of application vulnerability
6.5.2 Cross reference
6.5.3 Mechanism of failure
6.5.4 Applicable language characteristics
6.5.5 Avoiding the vulnerability or mitigating its effects
6.5.6 Implications for standardization
6.6 Enumerator Issues [CCB] [Go to Page]
6.6.1 Description of application vulnerability
6.6.2 Cross reference
6.6.3 Mechanism of failure
6.6.4 Applicable language Characteristics
6.6.5 Avoiding the vulnerability or mitigating its effects
6.6.6 Implications for standardization
6.7 Numeric Conversion Errors [FLC] [Go to Page]
6.7.1 Description of application vulnerability
6.7.2 Cross reference
6.7.3 Mechanism of failure
6.7.4 Applicable language characteristics
6.7.5 Avoiding the vulnerability or mitigating its effects
6.7.6 Implications for standardization
6.8 String Termination [CJM] [Go to Page]
6.8.1 Description of application vulnerability
6.8.2 Cross reference
6.8.3 Mechanism of failure
6.8.4 Applicable language characteristics
6.8.5 Avoiding the vulnerability or mitigating its effects
6.8.6 Implications for standardization
6.9 Buffer Boundary Violation (Buffer Overflow) [HCB] [Go to Page]
6.9.1 Description of application vulnerability
6.9.2 Cross reference
6.9.3 Mechanism of failure
6.9.4 Applicable language characteristics
6.9.5 Avoiding the vulnerability or mitigating its effects
6.9.6 Implications for standardization
6.10 Unchecked Array Indexing [XYZ] [Go to Page]
6.10.1 Description of application vulnerability
6.10.2 Cross reference
6.10.3 Mechanism of failure
6.10.4 Applicable language characteristics
6.10.5 Avoiding the vulnerability or mitigating its effects
6.10.6 Implications for standardization
6.11 Unchecked Array Copying [XYW] [Go to Page]
6.11.1 Description of application vulnerability
6.11.2 Cross reference
6.11.3 Mechanism of failure
6.11.4 Applicable language characteristics
6.11.5 Avoiding the vulnerability or mitigating its effects
6.11.6 Implications for standardization
6.12 Pointer Casting and Pointer Type Changes [HFC] [Go to Page]
6.12.1 Description of application vulnerability
6.12.2 Cross reference
6.12.3 Mechanism of failure
6.12.4 Applicable language characteristics
6.12.5 Avoiding the vulnerability or mitigating its effects
6.12.6 Implications for standardization
6.13 Pointer Arithmetic [RVG] [Go to Page]
6.13.1 Description of application vulnerability
6.13.2 Cross reference
6.13.3 Mechanism of failure
6.13.4 Applicable language characteristics
6.13.5 Avoiding the vulnerability or mitigating its effects
6.13.6 Implications for standardization
6.14 Null Pointer Dereference [XYH] [Go to Page]
6.14.1 Description of application vulnerability
6.14.2 Cross reference
6.14.3 Mechanism of failure
6.14.4 Applicable language characteristics
6.14.5 Avoiding the vulnerability or mitigating its effects
6.14.6 Implications for standardization
6.15 Dangling Reference to Heap [XYK] [Go to Page]
6.15.1 Description of application vulnerability
6.15.2 Cross reference
6.15.3 Mechanism of failure
6.15.4 Applicable language characteristics
6.15.5 Avoiding the vulnerability or mitigating its effects
6.15.6 Implications for standardization
6.16 Arithmetic Wrap-around Error [FIF] [Go to Page]
6.16.1 Description of application vulnerability
6.16.2 Cross reference
6.16.3 Mechanism of failure
6.16.4 Applicable language characteristics
6.16.5 Avoiding the vulnerability or mitigating its effects
6.16.6 Implications for standardization
6.17 Using Shift Operations for Multiplication and Division [PIK] [Go to Page]
6.17.1 Description of application vulnerability
6.17.2 Cross reference
6.17.3 Mechanism of failure
6.17.4 Applicable language characteristics
6.17.5 Avoiding the vulnerability or mitigating its effects
6.17.6 Implications for standardization
6.18 Sign Extension Error [XZI] [Go to Page]
6.18.1 Description of application vulnerability
6.18.2 Cross reference
6.18.3 Mechanism of failure
6.18.4 Applicable language characteristics
6.18.5 Avoiding the vulnerability or mitigating its effects
6.18.6 Implications for standardization
6.19 Choice of Clear Names [NAI] [Go to Page]
6.19.1 Description of application vulnerability
6.19.2 Cross reference
6.19.3 Mechanism of Failure
6.19.4 Applicable language characteristics
6.19.5 Avoiding the vulnerability or mitigating its effects
6.19.6 Implications for standardization
6.20 Dead Store [WXQ] [Go to Page]
6.20.1 Description of application vulnerability
6.20.2 Cross reference
6.20.3 Mechanism of failure
6.20.4 Applicable language characteristics
6.20.5 Avoiding the vulnerability or mitigating its effects
6.20.6 Implications for standardization
6.21 Unused Variable [YZS] [Go to Page]
6.21.1 Description of application vulnerability
6.21.2 Cross reference
6.21.3 Mechanism of failure
6.21.4 Applicable language characteristics
6.21.5 Avoiding the vulnerability or mitigating its effects
6.21.6 Implications for standardization
6.22 Identifier Name Reuse [YOW] [Go to Page]
6.22.1 Description of application vulnerability
6.22.2 Cross reference
6.22.3 Mechanism of failure
6.22.4 Applicable language characteristics
6.22.5 Avoiding the vulnerability or mitigating its effects
6.22.6 Implications for standardization
6.23 Namespace Issues [BJL] [Go to Page]
6.23.1 Description of Application Vulnerability
6.23.2 Cross references
6.23.3 Mechanism of Failure
6.23.4 Applicable Language Characteristics
6.23.5 Avoiding the Vulnerability or Mitigating its Effects
6.23.6 Implications for Standardization
6.24 Initialization of Variables [LAV] [Go to Page]
6.24.1 Description of application vulnerability
6.24.2 Cross reference
6.24.3 Mechanism of failure
6.24.4 Applicable language characteristics
6.24.5 Avoiding the vulnerability or mitigating its effects
6.24.6 Implications for standardization
6.25 Operator Precedence/Order of Evaluation [JCW] [Go to Page]
6.25.1 Description of application vulnerability
6.25.2 Cross reference
6.25.3 Mechanism of failure
6.25.4 Applicable language characteristics
6.25.5 Avoiding the vulnerability or mitigating its effects
6.25.6 Implications for standardization
6.26 Side-effects and Order of Evaluation [SAM] [Go to Page]
6.26.1 Description of application vulnerability
6.26.2 Cross reference
6.26.3 Mechanism of failure
6.26.4 Applicable language characteristics
6.26.5 Avoiding the vulnerability or mitigating its effects
6.26.6 Implications for standardization
6.27 Likely Incorrect Expression [KOA] [Go to Page]
6.27.1 Description of application vulnerability
6.27.2 Cross reference
6.27.3 Mechanism of failure
6.27.4 Applicable language characteristics
6.27.5 Avoiding the vulnerability or mitigating its effects
6.27.6 Implications for standardization
6.28 Dead and Deactivated Code [XYQ] [Go to Page]
6.28.1 Description of application vulnerability
6.28.2 Cross reference
6.28.3 Mechanism of failure
6.28.4 Applicable language characteristics
6.28.5 Avoiding the vulnerability or mitigating its effects
6.28.6 Implications for standardization
6.29 Switch Statements and Static Analysis [CLL] [Go to Page]
6.29.1 Description of application vulnerability
6.29.2 Cross reference
6.29.3 Mechanism of failure
6.29.4 Applicable language characteristics
6.29.5 Avoiding the vulnerability or mitigating its effects
6.29.6 Implications for standardization
6.30 Demarcation of Control Flow [EOJ] [Go to Page]
6.30.1 Description of application vulnerability
6.30.2 Cross reference
6.30.3 Mechanism of failure
6.30.4 Applicable language characteristics
6.30.5 Avoiding the vulnerability or mitigating its effects
6.30.6 Implications for standardization
6.31 Loop Control Variables [TEX] [Go to Page]
6.31.1 Description of application vulnerability
6.31.2 Cross reference
6.31.3 Mechanism of failure
6.31.4 Applicable language characteristics
6.31.5 Avoiding the vulnerability or mitigating its effects
6.31.6 Implications for standardization
6.32 Off-by-one Error [XZH] [Go to Page]
6.32.1 Description of application vulnerability
6.32.2 Cross reference
6.32.3 Mechanism of failure
6.32.4 Applicable language characteristics
6.32.5 Avoiding the vulnerability or mitigating its effects
6.32.6 Implications for standardization
6.33 Structured Programming [EWD] [Go to Page]
6.33.1 Description of application vulnerability
6.33.2 Cross reference
6.33.3 Mechanism of failure
6.33.4 Applicable language characteristics
6.33.5 Avoiding the vulnerability or mitigating its effects
6.33.6 Implications for standardization
6.34 Passing Parameters and Return Values [CSJ] [Go to Page]
6.34.1 Description of application vulnerability
6.34.2 Cross reference
6.34.3 Mechanism of failure
6.34.4 Applicable language characteristics
6.34.5 Avoiding the vulnerability or mitigating its effects
6.34.6 Implications for standardization
6.35 Dangling References to Stack Frames [DCM] [Go to Page]
6.35.1 Description of application vulnerability
6.35.2 Cross reference
6.35.3 Mechanism of failure
6.35.4 Applicable language characteristics
6.35.5 Avoiding the vulnerability or mitigating its effects
6.35.6 Implications for standardization
6.36 Subprogram Signature Mismatch [OTR] [Go to Page]
6.36.1 Description of application vulnerability
6.36.2 Cross reference
6.36.3 Mechanism of failure
6.36.4 Applicable language characteristics
6.36.5 Avoiding the vulnerability or mitigating its effects
6.36.6 Implications for standardization
6.37 Recursion [GDL] [Go to Page]
6.37.1 Description of application vulnerability
6.37.2 Cross reference
6.37.3 Mechanism of failure
6.37.4 Applicable language characteristics
6.37.5 Avoiding the vulnerability or mitigating its effects
6.37.6 Implications for standardization
6.38 Ignored Error Status and Unhandled Exceptions [OYB] [Go to Page]
6.38.1 Description of application vulnerability
6.38.2 Cross reference
6.38.3 Mechanism of failure
6.38.4 Applicable language characteristics
6.38.5 Avoiding the vulnerability or mitigating its effects
6.38.6 Implications for standardization
6.39 Termination Strategy [REU] [Go to Page]
6.39.1 Description of application vulnerability
6.39.2 Cross reference
6.39.3 Mechanism of failure
6.39.4 Applicable language characteristics
6.39.5 Avoiding the vulnerability or mitigating its effects
6.39.6 Implications for standardization
6.40 Type-breaking Reinterpretation of Data [AMV] [Go to Page]
6.40.1 Description of application vulnerability
6.40.2 Cross reference
6.40.3 Mechanism of failure
6.40.4 Applicable language characteristics
6.40.5 Avoiding the vulnerability or mitigating its effects
6.40.6 Implications for standardization
6.41 Memory Leak [XYL] [Go to Page]
6.41.1 Description of application vulnerability
6.41.2 Cross reference
6.41.3 Mechanism of failure
6.41.4 Applicable language characteristics
6.41.5 Avoiding the vulnerability or mitigating its effects
6.41.6 Implications for standardization
6.42 Templates and Generics [SYM] [Go to Page]
6.42.1 Description of application vulnerability
6.42.2 Cross reference
6.42.3 Mechanism of failure
6.42.4 Applicable language characteristics
6.42.5 Avoiding the vulnerability or mitigating its effects
6.42.6 Implications for standardization
6.43 Inheritance [RIP] [Go to Page]
6.43.1 Description of application vulnerability
6.43.2 Cross reference
6.43.3 Mechanism of failure
6.43.4 Applicable language characteristics
6.43.5 Avoiding the vulnerability or mitigating its effects
6.43.6 Implications for standardization
6.44 Extra Intrinsics [LRM] [Go to Page]
6.44.1 Description of application vulnerability
6.44.2 Cross reference
6.44.3 Mechanism of failure
6.44.4 Applicable language characteristics
6.44.5 Avoiding the vulnerability or mitigating its effects
6.44.6 Implications for standardization
6.45 Argument Passing to Library Functions [TRJ] [Go to Page]
6.45.1 Description of application vulnerability
6.45.2 Cross reference
6.45.3 Mechanism of failure
6.45.4 Applicable language characteristics
6.45.5 Avoiding the vulnerability or mitigating its effects
6.45.6 Implications for standardization
6.46 Inter-language Calling [DJS] [Go to Page]
6.46.1 Description of application vulnerability
6.46.2 Cross reference
6.46.3 Mechanism of failure
6.46.4 Applicable language characteristics
6.46.5 Avoiding the vulnerability or mitigating its effects
Software developers can avoid the vulnerability or mitigate its ill effects in the following ways:
 Use the inter-language methods and syntax specified by the applicable language standard(s). For example, Fortran and Ada specify how to call C functions.
 Understand the calling conventions of all languages used.
 For items comprising the inter-language interface:
o Understand the data layout of all data types used.
o Understand the return conventions of all languages used.
o Avoid assuming that the language makes a distinction between upper case and lower case letters in identifiers.
o Avoid using a special character as the first character in identifiers.
o Avoid using long identifier names.
6.46.6 Implications for standardization
In future standardization activities, the following items should be considered:
 Standards committees should consider developing standard provisions for inter-language calling with languages most often used with their programming language.
6.47 Dynamically-linked Code and Self-modifying Code [NYY] [Go to Page]
6.47.1 Description of application vulnerability
6.47.2 Cross reference
6.47.3 Mechanism of failure
6.47.4 Applicable language characteristics
6.47.5 Avoiding the vulnerability or mitigating its effects
6.47.6 Implications for standardization
6.48 Library Signature [NSQ] [Go to Page]
6.48.1 Description of application vulnerability
6.48.2 Cross reference
6.48.3 Mechanism of failure
6.48.4 Applicable language characteristics
6.48.5 Avoiding the vulnerability or mitigating its effects
6.48.6 Implications for standardization
6.49 Unanticipated Exceptions from Library Routines [HJW] [Go to Page]
6.49.1 Description of application vulnerability
6.49.2 Cross reference
6.49.3 Mechanism of failure
6.49.4 Applicable language characteristics
6.49.5 Avoiding the vulnerability or mitigating its effects
6.49.6 Implications for standardization
6.50 Pre-processor Directives [NMP] [Go to Page]
6.50.1 Description of application vulnerability
6.50.2 Cross reference
6.50.3 Mechanism of failure
6.50.4 Applicable language characteristics
6.50.5 Avoiding the vulnerability or mitigating its effects
6.50.6 Implications for standardization
6.51 Suppression of Language-defined Run-time Checking [MXB] [Go to Page]
6.51.1 Description of application vulnerability
6.51.2 Cross reference
6.51.3 Mechanism of Failure
6.51.4 Applicable language characteristics
6.51.5 Avoiding the vulnerability
6.51.6 Implications for standardization
6.52 Provision of Inherently Unsafe Operations [SKL] [Go to Page]
6.52.1 Description of application vulnerability
6.52.2 Cross reference
6.52.3 Mechanism of Failure
6.52.4 Applicable language characteristics
6.52.5 Avoiding the vulnerability
6.53 Obscure Language Features [BRS] [Go to Page]
6.53.1 Description of application vulnerability
6.53.2 Cross reference
6.53.3 Mechanism of failure
6.53.4 Applicable language characteristics
6.53.5 Avoiding the vulnerability or mitigating its effects
6.53.6 Implications for standardization
6.54 Unspecified Behaviour [BQF] [Go to Page]
6.54.1 Description of application vulnerability
6.54.2 Cross reference
6.54.3 Mechanism of failure
6.54.4 Applicable language characteristics
6.54.5 Avoiding the vulnerability or mitigating its effects
6.54.6 Implications for standardization
6.55 Undefined Behaviour [EWF] [Go to Page]
6.55.1 Description of application vulnerability
6.55.2 Cross reference
6.55.3 Mechanism of failure
6.55.4 Applicable language characteristics
6.55.5 Avoiding the vulnerability or mitigating its effects
6.55.6 Implications for standardization
6.56 Implementation-defined Behaviour [FAB] [Go to Page]
6.56.1 Description of application vulnerability
6.56.2 Cross reference
6.56.3 Mechanism of failure
6.56.4 Applicable language characteristics
6.56.5 Avoiding the vulnerability or mitigating its effects
6.56.6 Implications for standardization
6.57 Deprecated Language Features [MEM] [Go to Page]
6.57.1 Description of application vulnerability
6.57.2 Cross reference
6.57.3 Mechanism of failure
6.57.4 Applicable language characteristics
6.57.5 Avoiding the vulnerability or mitigating its effects
6.57.6 Implications for standardization
7. Application Vulnerabilities [Go to Page]
7.1 General
7.2 Terminology
7.3 Unspecified Functionality [BVQ] [Go to Page]
7.3.1 Description of application vulnerability
7.3.2 Cross reference
7.3.3 Mechanism of failure
7.3.4 Avoiding the vulnerability or mitigating its effects
7.4 Distinguished Values in Data Types [KLK] [Go to Page]
7.4.1 Description of application vulnerability
7.4.2 Cross reference
7.4.3 Mechanism of failure
7.4.4 Avoiding the vulnerability or mitigating its effects
7.5 Adherence to Least Privilege [XYN] [Go to Page]
7.5.1 Description of application vulnerability
7.5.2 Cross reference
7.5.3 Mechanism of failure
7.5.4 Avoiding the vulnerability or mitigating its effects
7.6 Privilege Sandbox Issues [XYO] [Go to Page]
7.6.1 Description of application vulnerability
7.6.2 Cross reference
7.6.3 Mechanism of failure
7.6.4 Avoiding the vulnerability or mitigating its effects
7.7 Executing or Loading Untrusted Code [XYS] [Go to Page]
7.7.1 Description of application vulnerability
7.7.2 Cross reference
7.7.3 Mechanism of failure
7.7.4 Avoiding the vulnerability or mitigating its effects
7.7.5 Implications for standardization
7.8 Memory Locking [XZX] [Go to Page]
7.8.1 Description of application vulnerability
7.8.2 Cross reference
7.8.3 Mechanism of failure
7.8.4 Avoiding the vulnerability or mitigating its effects
7.8.5 Implications for standardization
7.9 Resource Exhaustion [XZP] [Go to Page]
7.9.1 Description of application vulnerability
7.9.2 Cross reference
7.9.3 Mechanism of failure
7.9.4 Avoiding the vulnerability or mitigating its effects
7.10 Unrestricted File Upload [CBF] [Go to Page]
7.10.2 Cross reference
7.10.3 Mechanism of failure
7.10.4 Avoiding the vulnerability or mitigating its effects
7.10.5 Implications for standardization
7.11 Resource Names [HTS] [Go to Page]
7.11.1 Description of application vulnerability
7.11.2 Cross reference
7.11.3 Mechanism of Failure
7.11.4 Avoiding the vulnerability or mitigating its effects
7.11.5 Implications for standardization
7.12 Injection [RST] [Go to Page]
7.12.1 Description of application vulnerability
7.12.2 Cross reference
7.12.3 Mechanism of failure
7.12.4 Avoiding the vulnerability or mitigating its effects
7.13 Cross-site Scripting [XYT] [Go to Page]
7.13.1 Description of application vulnerability
7.13.2 Cross reference
7.13.3 Mechanism of failure
7.13.4 Avoiding the vulnerability or mitigating its effects
7.14 Unquoted Search Path or Element [XZQ] [Go to Page]
7.14.1 Description of application vulnerability
7.14.2 Cross reference
7.14.3 Mechanism of failure
7.14.4 Avoiding the vulnerability or mitigating its effects
7.15 Improperly Verified Signature [XZR] [Go to Page]
7.15.1 Description of application vulnerability
7.15.2 Cross reference
7.15.3 Mechanism of failure
7.15.4 Avoiding the vulnerability or mitigating its effects
7.15.5 Implications for standardization
7.16 Discrepancy Information Leak [XZL] [Go to Page]
7.16.1 Description of application vulnerability
7.16.2 Cross reference
7.16.3 Mechanism of failure
7.16.4 Avoiding the vulnerability or mitigating its effects
7.17 Sensitive Information Uncleared Before Use [XZK] [Go to Page]
7.17.1 Description of application vulnerability
7.17.2 Cross reference
7.17.3 Mechanism of failure
7.17.4 Avoiding the vulnerability or mitigating its effects
7.18 Path Traversal [EWR] [Go to Page]
7.18.1 Description of application vulnerability
7.18.2 Cross reference
7.18.3 Mechanism of failure
7.18.4 Avoiding the vulnerability or mitigating its effects
7.19 Missing Required Cryptographic Step [XZS] [Go to Page]
7.19.1 Description of application vulnerability
7.19.2 Cross reference
7.19.3 Mechanism of failure
7.19.4 Avoiding the vulnerability or mitigating its effects
7.20 Insufficiently Protected Credentials [XYM] [Go to Page]
7.20.1 Description of application vulnerability
7.20 .2 Cross reference
7.20.3 Mechanism of failure
7.20.4 Avoiding the vulnerability or mitigating its effects
7.21 Missing or Inconsistent Access Control [XZN] [Go to Page]
7.21.1 Description of application vulnerability
7.21.2 Cross reference
7.21.3 Mechanism of failure
7.21.4 Avoiding the vulnerability or mitigating its effects
7.22 Authentication Logic Error [XZO] [Go to Page]
7.22.1 Description of application vulnerability
7.22.2 Cross reference
7.22.3 Mechanism of failure
7.22.4 Avoiding the vulnerability or mitigating its effects
7.23 Hard-coded Password [XYP] [Go to Page]
7.23.1 Description of application vulnerability
7.23.2 Cross reference
7.23.3 Mechanism of failure
7.23.4 Avoiding the vulnerability or mitigating its effects
8. New Vulnerabilities [Go to Page]
8.1 General
8.2 Terminology
8.3 Concurrency – Activation [CGA] [Go to Page]
8.3.1 Description of application vulnerability
8.3.2 Cross References
8.3.3 Mechanism of Failure
8.3.4 Applicable language characteristics
8.3.5 Avoiding the vulnerability or mitigating its effects
8.3.6 Implications for standardization
8.4 Concurrency – Directed termination [CGT] [Go to Page]
8.4.1 Description of application vulnerability
8.4.2 Cross references
8.4.3 Mechanism of failure
8.4.4 Applicable language characteristics
8.4.5 Avoiding the vulnerability or mitigating its effect
8.4.6 Implications for standardization
8.5 Concurrent Data Access [CGX] [Go to Page]
8.5.1 Description of application vulnerability
8.5.2 Cross references
8.5.3 Mechanism of failure
8.5.4 Applicable language characteristics
8.5.5 Avoiding the vulnerability or mitigating its effect
8.5.6 Implications for standardization
8.6 Concurrency – Premature Termination [CGS] [Go to Page]
8.6.1 Description of application vulnerability
8.6.2 Cross references
8.6.3 Mechanism of failure
8.6.4 Applicable language characteristics
8.6.5 Avoiding the vulnerability or mitigating its effect
8.6.6 Implications for standardization
8.7 Protocol Lock Errors [CGM] [Go to Page]
8.7.1 Description of application vulnerability
8.7.2 Cross references
8.7.3 Mechanism of failure
8.7.4 Applicable language characteristics
8.7.5 Avoiding the vulnerability or mitigating its effect
8.7.6 Implications for standardization
8.8 Inadequately Secure Communication of Shared Resources [CGY] [Go to Page]
8.8.1 Description of application vulnerability
8.8.2 Cross references
8.8.3 Mechanism of failure
8.8.4 Avoiding the vulnerability or mitigating its effect
Annex A (informative) Vulnerability Taxonomy and List [Go to Page]
A.1 General
A.2 Outline of Programming Language Vulnerabilities
A.3 Outline of Application Vulnerabilities
A.4 Vulnerability List
Annex B (informative) Language Specific Vulnerability Template
Annex C (informative) Vulnerability descriptions for the language Ada [Go to Page]
C.1 Identification of standards and associated documentation
C.2 General terminology and concepts
C.3 Type System [IHN] [Go to Page]
C.3.1 Applicability to language
C.3.2 Guidance to language users
C.4 Bit Representation [STR] [Go to Page]
C.4.1 Applicability to language
C.4.2 Guidance to language users
C.5 Floating-point Arithmetic [PLF] [Go to Page]
C.5.1 Applicability to language
C.5.2 Guidance to language users
C.6 Enumerator Issues [CCB] [Go to Page]
C.6.1 Applicability to language
C.6.2 Guidance to language users
C.7 Numeric Conversion Errors [FLC] [Go to Page]
C.7.1 Applicability to language
C.7.2 Guidance to language users
C.8 String Termination [CJM]
C.9 Buffer Boundary Violation (Buffer Overflow) [HCB]
C.10 Unchecked Array Indexing [XYZ] [Go to Page]
C.10.1 Applicability to language
C.10.2 Guidance to language users
C.11 Unchecked Array Copying [XYW]
C.12 Pointer Casting and Pointer Type Changes [HFC] [Go to Page]
C.12.1 Applicability to language
C.12.2 Guidance to language users
C.13 Pointer Arithmetic [RVG]
C.14 Null Pointer Dereference [XYH]
C.15 Dangling Reference to Heap [XYK] [Go to Page]
C.15.1 Applicability to language
C.15.2 Guidance to language users
C.16 Arithmetic Wrap-around Error [FIF]
C.17 Using Shift Operations for Multiplication and Division [PIK]
C.18 Sign Extension Error [XZI]
C.19 Choice of Clear Names [NAI] [Go to Page]
C.19.1 Applicability to language
C.19.2 Guidance to language users
C.20 Dead store [WXQ] [Go to Page]
C.20.1 Applicability to language
C.20.2 Guidance to Language Users
C.21 Unused Variable [YZS] [Go to Page]
C.21.1 Applicability to language
C.21.2 Guidance to language users
C.22 Identifier Name Reuse [YOW] [Go to Page]
C.22.1 Applicability to language
C.22.2 Guidance to language users
C.23 Namespace Issues [BJL]
C.24 Initialization of Variables [LAV] [Go to Page]
C.24.1 Applicability to language
C.24.2 Guidance to language users
C.25 Operator Precedence/Order of Evaluation [JCW] [Go to Page]
C.25.1 Applicability to language
C.25.2 Guidance to language users
C.26 Side-effects and Order of Evaluation [SAM] [Go to Page]
C.26.1 Applicability to language
C.26.2 Guidance to language users
C.27 Likely Incorrect Expression [KOA] [Go to Page]
C.27.1 Applicability to language
C.27.2 Guidance to language users
C.28 Dead and Deactivated Code [XYQ] [Go to Page]
C.28.1 Applicability to language
C.28.2 Guidance to language users
C.29 Switch Statements and Static Analysis [CLL] [Go to Page]
C.29.1 Applicability to language
C.29.2 Guidance to language users
C.30 Demarcation of Control Flow [EOJ]
C.31 Loop Control Variables [TEX]
C.32 Off-by-one Error [XZH] [Go to Page]
C.32.1 Applicability to language [Go to Page]
Confusion between the need for < and <= or > and >= in a test.
Confusion as to the index range of an algorithm.
Failing to allow for storage of a sentinel value.
C.32.2 Guidance to language users
C.33 Structured Programming [EWD] [Go to Page]
C.33.1 Applicability to language
C.33.2 Guidance to language users
C.34 Passing Parameters and Return Values [CSJ] [Go to Page]
C.34.1 Applicability to language
C.34.2 Guidance to language users
C.35 Dangling References to Stack Frames [DCM] [Go to Page]
C.35.1 Applicability to language
C.35.2 Guidance to language users
C.36 Subprogram Signature Mismatch [OTR] [Go to Page]
C.36.1 Applicability to language
C.36.2 Guidance to language users
C.37 Recursion [GDL] [Go to Page]
C.37.1 Applicability to language
C.37.2 Guidance to language users
C.38 Ignored Error Status and Unhandled Exceptions [OYB] [Go to Page]
C.38.1 Applicability to language
C.38.2 Guidance to language users
C.39 Termination Strategy [REU] [Go to Page]
C.39.1 Applicability to language
C.39.2 Guidance to language users
C.40 Type-breaking Reinterpretation of Data [AMV] [Go to Page]
C.40.1 Applicability to language
C.40.2 Guidance to language users
C.41 Memory Leak [XYL] [Go to Page]
C.41.1 Applicability to language
C.41.2 Guidance to language users
C.42 Templates and Generics [SYM]
C.43 Inheritance [RIP] [Go to Page]
C.43.1 Applicability to language
C.43.2 Guidance to language users
C.44 Extra Intrinsics [LRM]
C.45 Argument Passing to Library Functions [TRJ] [Go to Page]
C.45.1 Applicability to language
C.45.2 Guidance to language users
C.46 Inter-language Calling [DJS] [Go to Page]
C.46.1 Applicability to Language
C.46.2 Guidance to Language Users
C.47 Dynamically-linked Code and Self-modifying Code [NYY]
C.48 Library Signature [NSQ] [Go to Page]
C.48.1 Applicability to language
C.48.2 Guidance to language users
C.49 Unanticipated Exceptions from Library Routines [HJW] [Go to Page]
C.49.1 Applicability to language
C.49.2 Guidance to language users
C.50 Pre-Processor Directives [NMP]
C.51 Suppression of Language-defined Run-time Checking [MXB] [Go to Page]
C.51.1 Applicability to Language
C.51.2 Guidance to Language Users
C.52 Provision of Inherently Unsafe Operations [SKL] [Go to Page]
C.52.1 Applicability to Language
C.53 Obscure Language Features [BRS] [Go to Page]
C.53.1 Applicability to language
C.53.2 Guidance to language users
C.54 Unspecified Behaviour [BQF] [Go to Page]
C.54.1 Applicability to language
C.54.2 Guidance to language users
C.55 Undefined Behaviour [EWF] [Go to Page]
C.55.1 Applicability to language
C.55.2 Guidance to language users
C.56 Implementation-Defined Behaviour [FAB] [Go to Page]
C.56.1 Applicability to language
C.56.2 Guidance to language users
C.57 Deprecated Language Features [MEM] [Go to Page]
C.57.1 Applicability to language
C.57.2 Guidance to language users
C.58 Implications for standardization
Annex D (informative) Vulnerability descriptions for the language C [Go to Page]
D.1 Identification of standards and associated documents
D.2 General terminology and concepts
D.3 Type System [IHN] [Go to Page]
D.3.1 Applicability to language
D.3.2 Guidance to language users
D.4 Bit Representations [STR] [Go to Page]
D.4.1 Applicability to language
D.4.2 Guidance to language users
D.5 Floating-point Arithmetic [PLF] [Go to Page]
D.5.1 Applicability to language
D.5.2 Guidance to language users
D.6 Enumerator Issues [CCB] [Go to Page]
D.6.1 Applicability to language
D.6.2 Guidance to language users
D.7 Numeric Conversion Errors [FLC] [Go to Page]
D.7.1 Applicability to language
D.7.2 Guidance to language users
D.8 String Termination [CJM] [Go to Page]
D.8.1 Applicability to language
D.8.2 Guidance to language users
D.9 Buffer Boundary Violation (Buffer Overflow) [HCB] [Go to Page]
D.9.1 Applicability to language
D.9.2 Guidance to language users
D.10 Unchecked Array Indexing [XYZ] [Go to Page]
D.10.1 Applicability to language
D.10.2 Guidance to language users
D.11 Unchecked Array Copying [XYW] [Go to Page]
D.11.1 Applicability to language
D.11.2 Guidance to language users
D.12 Pointer Casting and Pointer Type Changes [HFC] [Go to Page]
D.12.1 Applicability to language
D.12.2 Guidance to language users
D.13 Pointer Arithmetic [RVG] [Go to Page]
D.13.1 Applicability to language
D.13.2 Guidance to language users
D.14 Null Pointer Dereference [XYH] [Go to Page]
D.14.1 Applicability to language
D.14.2 Guidance to language users
D.15 Dangling Reference to Heap [XYK] [Go to Page]
D.15.1 Applicability to language
D.15.2 Guidance to language users
D.16 Arithmetic Wrap-around Error [FIF] [Go to Page]
D.16.1 Applicability to language
D.16.2 Guidance to language users
D.17 Using Shift Operations for Multiplication and Division [PIK] [Go to Page]
D.17.1 Applicability to language
D.17.2 Guidance to language users
D.18 Sign Extension Error [XZI]
D.19 Choice of Clear Names [NAI] [Go to Page]
D.19.1 Applicability to language
D.19.2 Guidance to language users
D.20 Dead Store [WXQ] [Go to Page]
D.20.1 Applicability to Language
D.20.2 Guidance to Language Users
D.21 Unused Variable [YZS] [Go to Page]
D.21.1 Applicability to language
D.21.2 Guidance to language users
D.22 Identifier Name Reuse [YOW] [Go to Page]
D.22.1 Applicability to language
D.22.2 Guidance to language users
D.23 Namespace Issues [BJL]
D.24 Initialization of Variables [LAV] [Go to Page]
D.24.1 Applicability to language
D.24.2 Guidance to language users
D.25 Operator Precedence/Order of Evaluation [JCW] [Go to Page]
D.25.1 Applicability to language
D.25.2 Guidance to language users
D.26 Side-effects and Order of Evaluation [SAM] [Go to Page]
D.26.1 Applicability to language
D.26.2 Guidance to language users
D.27 Likely Incorrect Expression [KOA] [Go to Page]
D.27.1 Applicability to language
D.27.2 Guidance to language users
D.28 Dead and Deactivated Code [XYQ] [Go to Page]
D.28.1 Applicability to language
D.28.2 Guidance to language users
D.29 Switch Statements and Static Analysis [CLL] [Go to Page]
D.29.1 Applicability to language
D.29.2 Guidance to language users
D.30 Demarcation of Control Flow [EOJ] [Go to Page]
D.30.1 Applicability to language
D.30.2 Guidance to language users
D.31 Loop Control Variables [TEX] [Go to Page]
D.31.1 Applicability to language
D.31.2 Guidance to language users
D.32 Off-by-one Error [XZH] [Go to Page]
D.32.1 Applicability to language
D.32.2 Guidance to language users
D.33 Structured Programming [EWD] [Go to Page]
D.33.1 Applicability to language
D.33.2 Guidance to language users
D.34 Passing Parameters and Return Values [CSJ] [Go to Page]
D.34.1 Applicability to language
D.34.2 Guidance to language users
D.35 Dangling References to Stack Frames [DCM] [Go to Page]
D.35.1 Applicability to language
D.35.2 Guidance to language users
D.36 Subprogram Signature Mismatch [OTR] [Go to Page]
D.36.1 Applicability to language
D.36.2 Guidance to language users
D.37 Recursion [GDL] [Go to Page]
D.37.1 Applicability to language
D.37.2 Guidance to language users
D.38 Ignored Error Status and Unhandled Exceptions [OYB] [Go to Page]
D.38.1 Applicability to language
D.38.2 Guidance to language users
D.39 Termination Strategy [REU] [Go to Page]
D.39.1 Applicability to language
D.39.2 Guidance to language users
D.40 Type-breaking Reinterpretation of Data [AMV] [Go to Page]
D.40.1 Applicability to language
D.40.2 Guidance to language users
D.41 Memory Leak [XYL] [Go to Page]
D.41.1 Applicability to language
D.41.2 Guidance to language users
D.42 Templates and Generics [SYM]
D.43 Inheritance [RIP]
D.44 Extra Intrinsics [LRM]
D.45 Argument Passing to Library Functions [TRJ] [Go to Page]
D.45.1 Applicability to language
D.45.2 Guidance to language users
D.46 Inter-language Calling [DJS]
D.47 Dynamically-linked Code and Self-modifying Code [NYY] [Go to Page]
D.47.1 Applicability to language
D.47.2 Guidance to language users
D.48 Library Signature [NSQ] [Go to Page]
D.48.1 Applicability to language
D.48.2 Guidance to language users
D.49 Unanticipated Exceptions from Library Routines [HJW] [Go to Page]
D.49.1 Applicability to language
D.49.2 Guidance to language users
D.50 Pre-processor Directives [NMP] [Go to Page]
D.50.1 Applicability to language
D.50.2 Guidance to language users
D.51 Suppression of Language-defined Run-time Checking [MXB]
D.52 Provision of Inherently Unsafe Operations [SKL] [Go to Page]
D.52.1 Applicability to language
D.52.2 Guidance to language users
D.53 Obscure Language Features [BRS] [Go to Page]
D.53.1 Applicability to language
D.53.2 Guidance to language users
D.54 Unspecified Behaviour [BQF] [Go to Page]
D.54.1 Applicability to language
D.54.2 Guidance to language users
D.55 Undefined Behaviour [EWF] [Go to Page]
D.55.1 Applicability to language
D.55.2 Guidance to language users
D.56 Implementation-defined Behaviour [FAB] [Go to Page]
D.56.1 Applicability to language
D.56.2 Guidance to language users
D.57 Deprecated Language Features [MEM] [Go to Page]
D.57.1 Applicability to language
D.57.2 Guidance to language users
D.58 Implications for standardization
Annex E (informative) Vulnerability descriptions for the language Python [Go to Page]
E.1 Identification of standards and associated documents
E.2 General Terminology and Concepts [Go to Page]
E.2.1 General Terminology
E.2.2 Key Concepts
E.3 Type System [IHN] [Go to Page]
E.3.1 Applicability to language
E.3.2 Guidance to language users
E.4 Bit Representations [STR] [Go to Page]
E.4.1 Applicability to language
E.4.2 Guidance to language users
E.5 Floating-point Arithmetic [PLF] [Go to Page]
E.5.1 Applicability to language
E.5.2 Guidance to language users
E.6 Enumerator Issues [CCB] [Go to Page]
E.6.1 Applicability to language
E.6.2 Guidance to language users
E.7 Numeric Conversion Errors [FLC] [Go to Page]
E.7.1 Applicability to language
E.7.2 Guidance to language users
E.8 String Termination [CJM]
E.9 Buffer Boundary Violation [HCB]
E.10 Unchecked Array Indexing [XYZ]
E.11 Unchecked Array Copying [XYW]
E.12 Pointer Casting and Pointer Type Changes [HFC]
E.13 Pointer Arithmetic [RVG]
E.14 Null Pointer Dereference [XYH]
E.15 Dangling Reference to Heap [XYK]
E.16 Arithmetic Wrap-around Error [FIF] [Go to Page]
E.16.1 Applicability to language
E.16.2 Guidance to language users
E.17 Using Shift Operations for Multiplication and Division [PIK] [Go to Page]
E.17.1 Applicability to language
E.18 Sign Extension Error [XZI]
E.19 Choice of Clear Names [NAI] [Go to Page]
E.19.1 Applicability to language
E.19.2 Guidance to language users
E.20 Dead Store [WXQ] [Go to Page]
E.20.1 Applicability to language
E.20.2 Guidance to language users
E.21 Unused Variable [YZS]
E.22 Identifier Name Reuse [YOW] [Go to Page]
E.22.1 Applicability to language
E.22.2 Guidance to language users
E.23 Namespace Issues [BJL] [Go to Page]
E.23.1 Applicability to language
E.23.2 Guidance to language users
E.24 Initialization of Variables [LAV] [Go to Page]
E.24.1 Applicability of language
E.24.2 Guidance to language users
E.25 Operator Precedence/Order of Evaluation [JCW] [Go to Page]
E.25.1 Applicability to language
E.25.2 Guidance to language users
E.26 Side-effects and Order of Evaluation [SAM] [Go to Page]
E.26.1 Applicability to language
E.26.2 Guidance to language users
E.27 Likely Incorrect Expression [KOA] [Go to Page]
E.27.1 Applicability to language
E.27.2 Guidance to language users
E.28 Dead and Deactivated Code [XYQ] [Go to Page]
E.28.1 Applicability to language
E.28.2 Guidance to language users
E.29 Switch Statements and Static Analysis [CLL] [Go to Page]
E.29.1 Applicability to language
E.29.2 Guidance to language users
E.30 Demarcation of Control Flow [EOJ] [Go to Page]
E.30.1 Applicability to language
E.30.2 Guidance to language users
E.31 Loop Control Variables [TEX] [Go to Page]
E.31.1 Applicability to language
E.31.2 Guidance to language users
E.32 Off-by-one Error [XZH] [Go to Page]
E.32.1 Applicability to language
E.32.2 Guidance to language users
E.33 Structured Programming [EWD] [Go to Page]
E.33.1 Applicability to language
E.33.2 Guidance to language users
E.34 Passing Parameters and Return Values [CSJ] [Go to Page]
E.34.1 Applicability to language
E.34.2 Guidance to language users
E.35 Dangling References to Stack Frames [DCM]
E.36 Subprogram Signature Mismatch [OTR] [Go to Page]
E.36.1 Applicability to language
E.36.2 Guidance to language users
E.37 Recursion [GDL] [Go to Page]
E.37.1 Applicability to language
E.37.2 Guidance to language users
E.38 Ignored Error Status and Unhandled Exceptions [OYB] [Go to Page]
E.38.1 Applicability to language
E.38.2 Guidance to language users
E.39 Termination Strategy [REU] [Go to Page]
E.39.1 Applicability to language
E.39.2 Guidance to language users
E.40 Type-breaking Reinterpretation of Data [AMV]
E.41 Memory Leak [XYL] [Go to Page]
E.41.1 Applicability to language
E.41.2 Guidance to language users
E.42 Templates and Generics [SYM]
E.43 Inheritance [RIP] [Go to Page]
E.43.1 Applicability to language
E.43.2 Guidance to language users
E.44 Extra Intrinsics [LRM] [Go to Page]
E.44.1 Applicability to language
E.44.2 Guidance to language users
E.45 Argument Passing to Library Functions [TRJ] [Go to Page]
E.45.1 Applicability to language
E.45.2 Guidance to language users
E.46 Inter-language Calling [DJS] [Go to Page]
E.46.1 Applicability to language
E.46.2 Guidance to language users
E.47 Dynamically-linked Code and Self-modifying Code [NYY] [Go to Page]
E.47.1 Applicability to language
E.47.2 Guidance to language users
E.48 Library Signature [NSQ] [Go to Page]
E.48.1 Applicability to language
E.48.2 Guidance to language users
E.49 Unanticipated Exceptions from Library Routines [HJW] [Go to Page]
E.49.1 Applicability to language
E.49.2 Guidance to language users
E.50 Pre-processor Directives [NMP]
E.51 Suppression of Language-defined Run-time Checking [MXB]
E.52 Provision of Inherently Unsafe Operations [SKL] [Go to Page]
E.52.1 Applicability to language
E.52.2 Guidance to language users
E.53 Obscure Language Features [BRS] [Go to Page]
E.53.1 Applicability of language
E.53.2 Guidance to language users
E.54 Unspecified Behaviour [BQF] [Go to Page]
E.54.1 Applicability of language
E.54.2 Guidance to language users
E.55 Undefined Behaviour [EWF] [Go to Page]
E.55.1 Applicability to language
E.55.2 Guidance to language users
E.56 Implementation–defined Behaviour [FAB] [Go to Page]
E.56.1 Applicability to language
E.56.2 Guidance to language users
E.57 Deprecated Language Features [MEM] [Go to Page]
E.57.1 Applicability to language
E.57.2 Guidance to language users
Annex F (informative) Vulnerability descriptions for the language Ruby [Go to Page]
F.1 Identification of standards and associated documents
F.2 General Terminology and Concepts
F.3 Type System [IHN] [Go to Page]
F.3.1 Applicability to language
F.3.2 Guidance to language users
F.4 Bit Representations [STR] [Go to Page]
F.4.1 Applicability to language
F.4.2 Guidance to language users
F.5 Floating-point Arithmetic [PLF] [Go to Page]
F.5.1 Applicability to language
F.5.2 Guidance to language users
F.6 Enumerator Issues [CCB] [Go to Page]
F.6.1 Applicability to language
F.6.2 Guidance to language users
F.7 Numeric Conversion Errors [FLC] [Go to Page]
F.7.1 Applicability to language
F.7.2 Guidance to language users
F.8 String Termination [CJM]
F.9 Buffer Boundary Violation (Buffer Overflow) [HCB]
F.10 Unchecked Array Indexing [XYZ]
F.11 Unchecked Array Copying [XYW]
F.12 Pointer Casting and Pointer Type Changes [HFC]
F.13 Pointer Arithmetic [RVG]
F.14 Null Pointer Dereference [XYH]
F.15 Dangling Reference to Heap [XYK]
F.16 Arithmetic Wrap-around Error [FIF]
F.17 Using Shift Operations for Multiplication and Division [PIK]
F.18 Sign Extension Error [XZI]
F.19 Choice of Clear Names [NAI] [Go to Page]
F.19.1 Applicability to language
F.19.2 Guidance to language users
F.20 Dead Store [WXQ] [Go to Page]
F.20.1 Applicability to language
F.20.2 Guidance to language users
F.21 Unused Variable [YZS] [Go to Page]
F.21.1 Applicability to language
F.21.2 Guidance to language users
F.22 Identifier Name Reuse [YOW] [Go to Page]
F.22.1 Applicability to language
F.22.2 Guidance to language users
F.23 Namespace Issues [BJL] [Go to Page]
F.23.1 Applicability to language
F.23.2 Guidance to language users
F.24 Initialization of Variables [LAV]
F.25 Operator Precedence/Order of Evaluation [JCW] [Go to Page]
F.25.1 Applicability to language
F.25.2 Guidance to language users
F.26 Side-effects and Order of Evaluation [SAM] [Go to Page]
F.26.1 Applicability to language
F.26.2 Guidance to language users
F.27 Likely Incorrect Expression [KOA] [Go to Page]
F.27.1 Applicability to language
F.27.2 Guidance to language users
F.28 Dead and Deactivated Code [XYQ] [Go to Page]
F.28.1 Applicability to language
F.28.2 Guidance to language users
F.29 Switch Statements and Static Analysis [CLL] [Go to Page]
F.29.1 Applicability to language
F.29.2 Guidance to language users
F.30 Demarcation of Control Flow [EOJ]
F.31 Loop Control Variables [TEX] [Go to Page]
F.31.1 Applicability to language
F.31.2 Guidance to language users
F.32 Off-by-one Error [XZH] [Go to Page]
F.32.1 Applicability to language
F.32.2 Guidance to language users
F.33 Structured Programming [EWD] [Go to Page]
F.33.1 Applicability to language
F.33.2 Guidance to language users
F.34 Passing Parameters and Return Values [CSJ] [Go to Page]
F.34.1 Applicability to language
F.34.2 Guidance to language users
F.35 Dangling References to Stack Frames [DCM]
F.36 Subprogram Signature Mismatch [OTR] [Go to Page]
F.36.1 Applicability to language
F.36.2 Guidance to language users
F.37 Recursion [GDL] [Go to Page]
F.37.1 Applicability to language
F.37.2 Guidance to language users
F.38 Ignored Error Status and Unhandled Exceptions [OYB] [Go to Page]
F.38.1 Applicability to language
F.38.2 Guidance to language users
F.39 Termination Strategy [REU] [Go to Page]
F.39.1 Applicability to language
F.39.2 Guidance to language users
F.40 Type-breaking Reinterpretation of Data [AMV]
F.41 Memory Leak [XYL]
F.42 Templates and Generics [SYM]
F.43 Inheritance [RIP] [Go to Page]
F.43.1 Applicability to language
F.43.2 Guidance to language users
F.44 Extra Intrinsics [LRM]
F.45 Argument Passing to Library Functions [TRJ] [Go to Page]
F.45.1 Applicability to language
F.45.2 Guidance to language users
F.46 Inter-language Calling [DJS] [Go to Page]
F.46.1 Applicability to language
F.46.2 Guidance to language users
F.47 Dynamically-linked Code and Self-modifying Code [NYY] [Go to Page]
F.47.1 Applicability to language
F.47.2 Guidance to language users
F.48 Library Signature [NSQ] [Go to Page]
F.48.1 Applicability to language
F.48.2 Guidance to language users
F.49 Unanticipated Exceptions from Library Routines [HJW] [Go to Page]
F.49.1 Applicability to language
F.49.2 Guidance to language users
F.50 Pre-processor Directives [NMP]
F.51 Suppression of Language-defined Run-time Checking [MXB]
F.52 Provision of Inherently Unsafe Operations [SKL]
F.53 Obscure Language Features [BRS]
F.54 Unspecified Behaviour [BQF] [Go to Page]
F.54.1 Applicability of language
F.54.2 Guidance to language users
F.55 Undefined Behaviour [EWF] [Go to Page]
F.55.1 Applicability to language
F.55.2 Guidance to language users
F.56 Implementation-defined Behaviour [FAB] [Go to Page]
F.56.1 Applicability to language
F.56.2 Guidance to language users
F.57 Deprecated Language Features [MEM]
Annex G (informative) Vulnerability descriptions for the language SPARK [Go to Page]
G.1 Identification of standards and associated documentation
G.2 General terminology and concepts
G.3 Type System [IHN]
G.4 Bit Representation [STR]
G.5 Floating-point Arithmetic [PLF]
G.6 Enumerator Issues [CCB]
G.7 Numeric Conversion Errors [FLC]
G.8 String Termination [CJM]
G.9 Buffer Boundary Violation (Buffer Overflow) [HCB]
G.10 Unchecked Array Indexing [XYZ]
G.11 Unchecked Array Copying [XYW]
G.12 Pointer Casting and Pointer Type Changes [HFC]
G.13 Pointer Arithmetic [RVG]
G.14 Null Pointer Dereference [XYH]
G.15 Dangling Reference to Heap [XYK]
G.16 Arithmetic Wrap-around Error [FIF]
G.17 Using Shift Operations for Multiplication and Division [PIK]
G.18 Sign Extension Error [XZI]
G.19 Choice of Clear Names [NAI]
G.20 Dead store [WXQ]
G.21 Unused Variable [YZS]
G.22 Identifier Name Reuse [YOW]
G.23 Namespace Issues [BJL]
G.24 Initialization of Variables [LAV]
G.25 Operator Precedence/Order of Evaluation [JCW]
G.26 Side-effects and Order of Evaluation [SAM]
G.27 Likely Incorrect Expression [KOA]
G.28 Dead and Deactivated Code [XYQ]
G.29 Switch Statements and Static Analysis [CLL]
G.30 Demarcation of Control Flow [EOJ]
G.31 Loop Control Variables [TEX]
G.32 Off-by-one Error [XZH]
G.33 Structured Programming [EWD]
G.34 Passing Parameters and Return Values [CSJ]
G.35 Dangling References to Stack Frames [DCM]
G.36 Subprogram Signature Mismatch [OTR]
G.37 Recursion [GDL]
G.38 Ignored Error Status and Unhandled Exceptions [OYB]
G.39 Termination Strategy [REU]
G.40 Type-breaking Reinterpretation of Data [AMV]
G.41 Memory Leak [XYL]
G.42 Templates and Generics [SYM]
G.43 Inheritance [RIP]
G.44 Extra Intrinsics [LRM]
G.45 Argument Passing to Library Functions [TRJ]
G.46 Inter-language Calling [DJS]
G.47 Dynamically-linked Code and Self-modifying Code [NYY]
G.48 Library Signature [NSQ]
G.49 Unanticipated Exceptions from Library Routines [HJW]
G.50 Pre-Processor Directives [NMP]
G.51 Suppression of Language-defined Run-time Checking [MXB]
G.52 Provision of Inherently Unsafe Operations [SKL]
G.53 Obscure Language Features [BRS]
G.54 Unspecified Behaviour [BQF]
G.55 Undefined Behaviour [EWF]
G.56 Implementation-Defined Behaviour [FAB]
G.57 Deprecated Language Features [MEM]
G.58 Implications for standardization
Annex H (informative) Vulnerability descriptions for the language PHP [Go to Page]
H.1 Identification of standards and associated documentation
H.2 General Terminology and Concepts [Go to Page]
H.2.1 General Terminology
H.2.2 Key Concepts
H.3 Type System [IHN] [Go to Page]
H.3.1 Applicability to Language
H.3.2 Guidance to Language Users
H.4 Bit Representations [STR] [Go to Page]
H.4.1 Applicability to Language
H.4.2 Guidance to Language Users
H.5 Floating-point Arithmetic [PLF] [Go to Page]
H.5.1 Applicability to Language
H.5.2 Guidance to Language Users
H.6 Enumerator Issues [CCB] [Go to Page]
H.6.1 Applicability to Language
H.6.2 Guidance to Language Users
H.7 Numeric Conversion Errors [FLC] [Go to Page]
H.7.1 Applicability to Language
H.7.2 Guidance to Language Users
H.8 String Termination [CJM] [Go to Page]
H.8.1 Applicability to Language
H.8.2 Guidance to Language Users
H.9 Buffer Boundary Violation (Buffer Overflow) [HCB]
H.10 Unchecked Array Indexing [XYZ]
H.11 Unchecked Array Copying [XYW]
H.12 Pointer Casting and Pointer Type Changes [HFC]
H.13 Pointer Arithmetic [RVG]
H.14 Null Pointer Dereference [XYH]
H.15 Dangling Reference to Heap [XYK]
H.16 Arithmetic Wrap-around Error [FIF] [Go to Page]
H.16.1 Applicability to Language
H.16.2 Guidance to Language Users
H.17 Using Shift Operations for Multiplication and Division [PIK] [Go to Page]
H.17.1 Applicability to Language
H.17.2 Guidance to Language Users
H.18 Sign Extension Error [XZI]
H.19 Choice of Clear Names [NAI] [Go to Page]
H.19.1 Applicability to Language
H.19.2 Guidance to Language Users
H.20 Dead Store [WXQ] [Go to Page]
H.20.1 Applicability to Language
H.20.2 Guidance to Language Users
H.21 Unused Variable [YZS]
H.22 Identifier Name Reuse [YOW] [Go to Page]
H.22.1 Applicability to Language
H.22.2 Guidance to Language Users
H.23 Namespace Issues [BJL] [Go to Page]
H.23.1 Applicability to Language
H.23.2 Guidance to Language Users
H.24 Initialization of Variables [LAV] [Go to Page]
H.24.1 Applicability of language
H.24.2 Guidance to Language Users
H.25 Operator Precedence/Order of Evaluation [JCW] [Go to Page]
H.25.1 Applicability to Language
H.25.2 Guidance to Language Users
H.26 Side-effects and Order of Evaluation [SAM] [Go to Page]
H.26.1 Applicability to Language
H.26.2 Guidance to Language Users
H.27 Likely Incorrect Expression [KOA] [Go to Page]
H.27.1 Applicability to Language
H.27.2 Guidance to Language Users
H.28 Dead and Deactivated Code [XYQ] [Go to Page]
H.28.1 Applicability to Language
H.28.2 Guidance to Language Users
H.29 Switch Statements and Static Analysis [CLL] [Go to Page]
H.29.1 Applicability to Language
H.29.2 Guidance to Language Users
H.30 Demarcation of Control Flow [EOJ] [Go to Page]
H.30.1 Applicability to Language
H.30.2 Guidance to Language Users
H.31 Loop Control Variables [TEX] [Go to Page]
H.31.1 Applicability to Language
H.31.2 Guidance to Language Users
H.32 Off-by-one Error [XZH] [Go to Page]
H.32.1 Applicability to Language
H.32.2 Guidance to Language Users
H.33 Structured Programming [EWD] [Go to Page]
H.33.1 Applicability to Language
H.33.2 Guidance to Language Users
H.34 Passing Parameters and Return Values [CSJ] [Go to Page]
H.34.1 Applicability to Language
H.34.2 Guidance to Language Users
H.35 Dangling References to Stack Frames [DCM]
H.36 Subprogram Signature Mismatch [OTR] [Go to Page]
H.36.1 Applicability to Language
H.36.2 Guidance to Language Users
H.37 Recursion [GDL] [Go to Page]
H.37.1 Applicability to Language
H.37.2 Guidance to Language Users
H.38 Ignored Error Status and Unhandled Exceptions [OYB] [Go to Page]
H.38.1 Applicability to Language
H.38.2 Guidance to Language Users
H.39 Termination Strategy [REU] [Go to Page]
H.39.1 Applicability to Language
H.39.2 Guidance to Language Users
H.40 Type-breaking Reinterpretation of Data [AMV]
H.41 Memory Leak [XYL] [Go to Page]
H.41.1 Applicability to Language
H.41.2 Guidance to Language Users
H.42 Templates and Generics [SYM]
H.43 Inheritance [RIP] [Go to Page]
H.43.1 Applicability to Language
H.43.2 Guidance to Language Users
H.44 Extra Intrinsics [LRM]
H.45 Argument Passing to Library Functions [TRJ] [Go to Page]
H.45.1 Applicability to Language
H.45.2 Guidance to language users
H.46 Inter-language Calling [DJS] [Go to Page]
H.46.1 Applicability to Language
H.46.2 Guidance to Language Users
H.47 Dynamically-linked Code and Self-modifying Code [NYY] [Go to Page]
H.47.1 Applicability to Language
H.47.2 Guidance to Language Users
H.48 Library Signature [NSQ] [Go to Page]
H.48.1 Applicability to Language
H.48.2 Guidance to Language Users
H.49 Unanticipated Exceptions from Library Routines [HJW] [Go to Page]
H.49.1 Applicability to Language
H.49.2 Guidance to Language Users
H.50 Pre-processor Directives [NMP]
H.51 Suppression of Run-time Checking [MXB] [Go to Page]
H.51.1 Applicability to Language
H.51.2 Guidance to Language Users
H.52 Provision of Inherently Unsafe Operations [SKL] [Go to Page]
H.52.1 Applicability of language
H.52.2 Guidance to Language Users
H.53 Obscure Language Features [BRS] [Go to Page]
H.53.1 Applicability of language
H.53.2 Guidance to Language Users
H.54 Unspecified Behaviour [BQF] [Go to Page]
H.54.1 Applicability of language
H.54.2 Guidance to Language Users
H.55 Undefined Behaviour [EWF] [Go to Page]
H.55.1 Applicability to Language
H.55.2 Guidance to Language Users
H.56 Implementation–defined Behaviour [FAB] [Go to Page]
H.56.1 Applicability to Language
H.56.2 Guidance to Language Users
H.57 Deprecated Language Features [MEM] [Go to Page]
H.57.1 Applicability to Language
H.57.2 Guidance to Language Users
Bibliography
Index
Blank Page [Go to Page]

Email *
Password *
Confirm *
First Name *
Last Name *
Title
Company Name *
Company Size *
Industry *
Address *
Address 2
City *
State *	Zip *
Country *
Phone *
How did you hear about MADCAD.com? *

Company*
Full name*
Email*
Phone

Full name*
Email*
Phone
Your selection

MADCAD.com Free Trial

Report To Us

Contact us for a custom quote

⨯To continue with accurate pricing,
please select your company type below:

⨯We need your input!

⨯ We need your input!

⨯We need your input!

⨯We need your input!

Cart Warning

PD ISO/IEC TR 24772:2013 Information technology. Programming languages. Guidance to avoiding vulnerabilities in programming languages through language selection and use, 2013

Username:
Password:

Company Industry
Number Of Employees
Revenue

MADCAD.com Free Trial

Report To Us

Contact us for a custom quote

⨯To continue with accurate pricing, please select your company type below:

⨯We need your input!

⨯ We need your input!

⨯We need your input!

⨯We need your input!

Cart Warning

PD ISO/IEC TR 24772:2013 Information technology. Programming languages. Guidance to avoiding vulnerabilities in programming languages through language selection and use, 2013

⨯To continue with accurate pricing,
please select your company type below: