[CERT C 시큐어코딩표준-03] 표현식(EXP)

제안

---

EXP00-C.  연산자 우선순위를 나타내는 데 괄호를 사용한다.

EXP02-C.  논리연산자 AND 와 OR 의 단축 평가 방식을 알고 있어야 한다.

EXP03-C.  구조체의 크기가 구조체 멤버들 크기의 합이라고 가정하지 말아야 한다.

EXP05-C.  const를 캐스트로 없애지 않아야 한다.

EXP07-C.  표현식의 상수에 특정 값을 가정함으로써 상수를 사용해 얻는 이득을 없애지 말아야 한다.

EXP08-C.  포인터 연산이 정확하게 수행되고 있는지 보장해야 한다.

EXP09-C.  타입이나 변수의 크기를 결정 할 때는 sizeof 를 사용한다.

EXP10-C.  하위 표현식의 평가 순서나 부수 효과가 발생할 수 있는 영역의 순서에 의존하지 않아야 한다.

EXP11-C. 비트 필드 구조의 레이아웃에 대한 가정을하지 않는다.

EXP12-C. 함수에 의해 반환되는 값을 무시하지 않는다.

EXP13-C. Treat relational and equality operators as if they were nonassociative

EXP14-C. Beware of integer promotion when performing bitwise operations on integer types smaller than int

EXP15-C. Do not place a semicolon on the same line as an if, for, or while statement

EXP16-C. Do not compare function pointers to constant values

EXP17-C. Do not perform bitwise operations in conditional expressions

EXP19-C. Use braces for the body of an if, for, or while statement

EXP20-C. Perform explicit tests to determine success, true and false, and equality

EXP21-C. Place constants on the left of equality comparisons

규칙

---

EXP30-C. Do not depend on order of evaluation for side effects

EXP32-C. Do not access a volatile object through a nonvolatile reference

EXP33-C. Do not read uninitialized memory

EXP34-C. Do not dereference null pointers

EXP35-C. Do not modify objects with temporary lifetime

EXP36-C. Do not convert pointers into more strictly aligned pointer types

EXP37-C. Call functions with the correct number and type of arguments

EXP39-C. Do not access a variable through a pointer of an incompatible type

EXP40-C. Do not modify constant objects

EXP42-C. Do not compare padding data

EXP43-C. Avoid undefined behaviors when using restrict-qualified pointers

EXP44-C. Do not use side effects in operands to sizeof, _Alignof, or _Generic

EXP45-C. Do not perform assignments in selection statements

위험평가요약

---

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
EXP00-C	Low	Probable	Medium	P4	L3
EXP02-C	Low	Unlikely	Medium	P2	L3
EXP03-C	Medium	Unlikely	High	P2	L3
EXP05-C	Medium	Probable	Medium	P8	L2
EXP07-C	Low	Unlikely	Medium	P2	L3
EXP08-C	High	Probable	High	P6	L2
EXP09-C	High	Unlikely	Medium	P6	L2
EXP10-C	Medium	Probable	Medium	P8	L2
EXP11-C	Medium	Probable	Medium	P8	L2
EXP12-C	Medium	Unlikely	Medium	P4	L3
EXP13-C	Low	Unlikely	Medium	P2	L3
EXP14-C	low	likely	high	P3	L3
EXP16-C	Low	Likely	Medium	P6	L2
EXP19-C	Medium	Probable	Medium	P8	L2
EXP20-C	Medium	Probable	Low	P12	L1
EXP21-C	Low	Likely	Medium	P6	L2
EXP30-C	Medium	Probable	Medium	P8	L2
EXP32-C	Low	Likely	Medium	P6	L2
EXP33-C	High	Probable	Medium	P12	L1
EXP34-C	High	Likely	Medium	P18	L1
EXP35-C	Low	Probable	Medium	P4	L3
EXP36-C	Low	Probable	Medium	P4	L3
EXP37-C	Medium	Probable	High	P4	L3
EXP39-C	Medium	Unlikely	High	P2	L3
EXP40-C	Low	Unlikely	Medium	P2	L3
EXP42-C	Medium	Probable	Medium	P8	L2
EXP43-C	Medium	Probable	High	P4	L3
EXP44-C	Low	Unlikely	Low	P3	L3
EXP45-C	Low	Likely	Medium	P6	L2

출처: https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=358