Achieve Cert C Compliance Seamlessly with CppDepend
Achieve Cert C Compliance Seamlessly with CppDepend
In todays competitive software development landscape, maintaining high-quality and secure code is essential. The Cert C coding standard serves as a guideline for creating reliable and safe C applications. But how can developers efficiently achieve Cert C compliance in their projects?
Enter CppDepend, a comprehensive tool specifically designed to help you navigate the complexities of the Cert C standard. By utilizing static analysis techniques, CppDepend not only guides you towards compliance, but also empowers you to enhance overall code quality and security.
To learn Cert C Standards, you can print this SEI CERT C Coding Standard documentation by Carnegie Mellon University.
Using Cert C Rules in CppDepend
When you create a new CppDepend Project, a pop-up will appear displaying all the coding standards you would like to include in your analysis. To include Cert C coding standards, check the Cert option and choose Cert C.
After analyzing your project, Navigate to the Queries and Rules Explorer section, and select the Cert C Rules from the left-hand menu (Highlighted in red in the image below). This will display all the related Cert C rules on the right. Upon clicking a Rule, the corresponding CQLinq query and the relevant source code will be automatically generated. Additionally, the Metrics View section provides a visualization of the issue location and significance.
Incorporating Cert C Rules into the HTML Report
To include the Cert C rules in the generated HTML Report (available in the DevOps Edition), simply right-click on the Cert C group and select "List Code Queries of this Group in a dedicated section in Report."
List of Cert C Rules
CppDepend offers support for 38 Cert C standard queries.
To gain a deeper understanding of each rule and its functionality, please consult SEI CERT C Coding Standard documentation by Carnegie Mellon University.
Preprocessor (PRE)
PRE30-C: Do not create a universal character name through concatenation:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="warn_ucn_escape_incomplete"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}PRE31-C: Avoid side effects in arguments to unsafe macros:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang-Tidy" && issue.Type=="bugprone-macro-repeated-side-effects"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}Declarations and Initialization
DCL30-C: Declare objects with appropriate storage durations:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="CppCheck" && issue.Type=="danglingLifetime"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}DCL31-C:Declare identifiers before using them:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="err_missing_type_specifier"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}DCL37-C:Do not declare or define a reserved identifier:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="warn_pp_macro_is_reserved_id" select
new { issue,issue.FilePath,Line=issue.BeginLine}DCL41-C: Do not declare variables inside a switch statement before the first case label:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.Type=="Rule6-4-4"
select new { issue,issue.FilePath,Line=issue.BeginLine}Expressions(Exp)
EXP30-C: Do not depend on the order of evaluation for side effects:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="warn_unsequenced_mod_use" select
new { issue,issue.FilePath,Line=issue.BeginLine}EXP32-C: Do not access a volatile object through a nonvolatile reference:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="Clang"
&& issue.Type=="err_typecheck_convert_incompatible_volatile" select
new { issue,issue.FilePath,Line=issue.BeginLine}EXP33-C:Do not read uninitialized memory:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="CppCheck" && (issue.Type=="uninitvar" || issue.Type=="uninitdata") select
new { issue,issue.FilePath,Line=issue.BeginLine}EXP34-C: Do not dereference null pointers:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="CppCheck" && issue.Type=="nullPointer" select
new { issue,issue.FilePath,Line=issue.BeginLine}EXP35-C: Do not modify objects with temporary lifetime:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="Clang"
&& issue.Type=="err_typecheck_expression_not_modifiable_lvalue" select
new { issue,issue.FilePath,Line=issue.BeginLine}EXP36-C: Do not cast pointers into more strictly aligned pointer types:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="warn_cast_align" select
new { issue,issue.FilePath,Line=issue.BeginLine}EXP37-C: Call functions with the correct number and type of arguments:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="err_typecheck_call_too_many_args" select
new { issue,issue.FilePath,Line=issue.BeginLine}EXP39-C: Do not access a variable through a pointer of an incompatible type:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="CppCheck" && issue.Type=="invalidPointerCast" select
new { issue,issue.FilePath,Line=issue.BeginLine}EXP40-C: Do not modify constant objects:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="err_typecheck_convert_incompatible_const" select
new { issue,issue.FilePath,Line=issue.BeginLine}EXP44-C: Do not rely on side effects in operands to sizeof,\_Alignof, or \_Generic:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="warn_side_effects_unevaluated_context"
&& issue.Description.Contains(("lambda")) select
new { issue,issue.FilePath,Line=issue.BeginLine}EXP45-C:Do not perform assignments in selection statements:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="warn_condition_is_assignment" select
new { issue,issue.FilePath,Line=issue.BeginLine}EXP46-C. Do not use a bitwise operator with a Boolean-like operand:
This coding standard is computed with the following query:
warnif **count** > **0**
from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="warn_precedence_bitwise_rel" select
new { issue,issue.FilePath,Line=issue.BeginLine}Floating Point (FLP)
FLP30-C:Do not use floating-point variables as loop counters:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang-Tidy" && issue.Type=="cert-flp30-c"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}FLP34-C: Ensure that floating-point conversions are within range of the new type:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="warn_impcast_float_integer"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}Array (ARR)
ARR30-C. Do not form or use out-of-bounds pointers or array subscripts:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="CppCheck" && issue.Type=="arrayIndexOutOfBounds"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}ARR36-C: Do not subtract or compare two pointers that do not refer to the same array:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="CppCheck" && issue.Type=="comparePointers"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}ARR39-C: Do not add or subtract a scaled integer to a pointer:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="warn_ptr_arith_exceeds_bounds"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}Characters and Strings (STR)
STR30-C: Do not attempt to modify string literals:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="CppCheck" && issue.Type=="stringLiteralWrite"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}STR34-C: Cast characters to unsigned char before converting to larger integer sizes:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang-Tidy" && issue.Type=="bugprone-signed-char-misuse"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}Memory Management (MEM)
MEM30-C:Do not access freed memory:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="CppCheck" && issue.Type=="nullPointer"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}MEM31-C. Free dynamically allocated memory when no longer needed:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang" && issue.Type=="warn_mismatched_delete_new"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}Input/Output (FIO)
FIO38-C: Do not copy a FILE object:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang-Tidy" && issue.Type=="cert-fio38-c"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}FIO42-C: Close files when they are no longer needed:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="CppCheck" && issue.Type=="resourceLeak"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}Environment (ENV)
ENV33-C: Do not call system():
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="CppCheck" && issue.Type=="nullPointer"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}Signals (SIG)
SIG30-C: Call only asynchronous-safe functions within signal handlers:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang-Tidy" && issue.Type=="bugprone-signal-handler"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}Error Handling (ERR)
ERR34-C: Detect errors when converting a string to a number:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang-Tidy" && issue.Type=="cert-err34-c"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}Concurrency (CON)
CON36-C. Wrap functions that can spuriously wake up in a loop:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang-Tidy" && issue.Type=="bugprone-spuriously-wake-up-functions"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}Miscellaneous (MSC)
MSC30-C: Do not use the rand() function for generating pseudorandom numbers:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang-Tidy" && issue.Type=="cert-msc30-c"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}MSC32-C: Properly seed pseudorandom number generators:
This coding standard is computed with the following query:
warnif **count** > **0** from issue in **ImportedIssues** where issue.ToolName=="Clang-Tidy" && issue.Type=="cert-msc32-c"
select new { issue, issue.FilePath, Line = issue.BeginLine ,
Debt = **10**.ToMinutes().ToDebt(),
Severity =Severity.High
}Try CppDepend Today
Start your 14-day free trial with full access to all documentation features. No credit card required.