Source Code Analysis Laboratory (SCALe) for Energy ... - CERT
Source Code Analysis Laboratory (SCALe) for Energy ... - CERT
Source Code Analysis Laboratory (SCALe) for Energy ... - CERT
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
slash, or backslash. If it is, then the loop applies canonicalization algorithms. The bug occurs<br />
while calling a bounded function call:<br />
_tcscpy_s(previousLastSlash, pBufferEnd - previousLastSlash, ptr + 2);<br />
This is a violation of the <strong>CERT</strong> ® C Secure Coding rule “ARR30-C. Do not <strong>for</strong>m or use pointers or<br />
array subscripts that are out of bounds” and can be detected by the static analysis tools and techniques<br />
being implemented by <strong>CERT</strong>, part of Carnegie Mellon University’s Software Engineering<br />
Institute, and deployed in <strong>SCALe</strong>.<br />
<strong>CERT</strong> takes a comprehensive approach to identifying and eliminating software vulnerabilities and<br />
other flaws. <strong>CERT</strong> produces books and courses that foster a security mindset in developers, and it<br />
develops secure coding standards and automated analysis tools to help them code securely. Secure<br />
coding standards provide a detailed enumeration of coding errors that have caused vulnerabilities,<br />
along with their mitigations <strong>for</strong> the most commonly used software development languages. <strong>CERT</strong><br />
also works with vendors and researchers to develop analyzers that can detect violations of the secure<br />
coding standards.<br />
Improving software security by implementing code that con<strong>for</strong>ms to the <strong>CERT</strong> secure coding<br />
standards can be a significant investment <strong>for</strong> a software developer, particularly when refactoring<br />
or otherwise modernizing existing software systems [Seacord 2003]. However, a software developer<br />
does not always benefit from this investment because it is not easy to market code quality.<br />
1.2 <strong>SCALe</strong><br />
To address these problems, <strong>CERT</strong> has created the <strong>Source</strong> <strong>Code</strong> <strong>Analysis</strong> <strong>Laboratory</strong> (<strong>SCALe</strong>),<br />
which offers con<strong>for</strong>mance testing of software systems to <strong>CERT</strong> secure coding standards.<br />
<strong>SCALe</strong> evaluates client source code using multiple analyzers, including static analysis tools, dynamic<br />
analysis tools, and fuzz testing. <strong>CERT</strong> reports any deviations from secure coding standards<br />
to the client. The client may then repair and resubmit the software <strong>for</strong> reevaluation. Once the reevaluation<br />
process is completed, <strong>CERT</strong> provides the client a report detailing the software’s con<strong>for</strong>mance<br />
or noncon<strong>for</strong>mance to each secure coding rule. The <strong>SCALe</strong> process consists of the sequence<br />
of steps shown in Figure 1.<br />
® <strong>CERT</strong> is a registered mark owned by Carnegie Mellon University.<br />
CMU/SEI-2010-TR-021 | 2
Change language