CERT C and C++ Secure Coding Standard IDs mapped to Klocwork C and C++ checkers

From current

See also C and C++ checker reference.

CERT ID	Klocwork Issue Code and Description
ARR30-C	ABR Buffer Overflow - Array Index Out of Bounds ABV.ANY_SIZE_ARRAY Buffer Overflow - Array Index Out of Bounds ABV.STACK Buffer Overflow - Local Array Index Out of Bounds ABV.TAINTED Buffer Overflow from Unvalidated Input SV.TAINTED.ALLOC_SIZE Use of Unvalidated Integer in Memory Allocation SV.TAINTED.CALL.INDEX_ACCESS Use of Unvalidated Integer as Array Index by Function Call SV.TAINTED.CALL.LOOP_BOUND Use of Unvalidated Integer in Loop Condition through a Function Call SV.TAINTED.INDEX_ACCESS Use of Unvalidated Integer as Array Index
ARR33-C	ABR Buffer Overflow - Array Index Out of Bounds
DCL30-C	LOCRET.ARG Function returns address of local variable LOCRET.GLOB Function returns address of local variable LOCRET.RET Function returns address of local variable
DCL31-C	RETVOID.GEN Non-void function returns void value RETVOID.IMPLICIT Implicitly int function returns void value
ENV04-C	SV.CODE_INJECTION.SHELL_EXEC Command Injection into Shell Execution SV.TAINTED.INJECTION Command Injection
EXP01-C	INCORRECT.ALLOC_SIZE Incorrect Allocation Size
EXP12-C	SV.RVT.RETVAL_NOTTESTED Ignored Return Value
EXP15-C	SEMICOL Suspiciously placed semicolon
EXP18-C	ASSIGCOND.CALL Assignment in condition (call) ASSIGCOND.GEN Assignment in condition
EXP33-C	UNINIT.HEAP.MIGHT Uninitialized Heap Use - possible UNINIT.HEAP.MUST Uninitialized Heap Use UNINIT.STACK.ARRAY.MIGHT Uninitialized Array - possible UNINIT.STACK.ARRAY.MUST Uninitialized Array UNINIT.STACK.ARRAY.PARTIAL.MUST Partially Uninitialized Array UNINIT.STACK.MIGHT Uninitialized Variable - possible UNINIT.STACK.MUST Uninitialized Variable
EXP33-CPP	UNINIT.CTOR.MIGHT Uninitialized Variable in Constructor - possible UNINIT.CTOR.MUST Uninitialized Variable in Constructor
EXP34-C	NPD.CHECK.CALL.MIGHT Pointer may be passed to function that can dereference it after it was positively checked for NULL NPD.CHECK.CALL.MUST Pointer will be passed to function that may dereference it after it was positively checked for NULL NPD.CHECK.MIGHT Pointer may be dereferenced after it was positively checked for NULL NPD.CHECK.MUST Pointer will be dereferenced after it was positively checked for NULL NPD.CONST.CALL NULL is passed to function that can dereference it NPD.CONST.DEREF NULL is dereferenced NPD.FUNC.CALL.MIGHT Result of function that may return NULL may be passed to another function that may dereference it NPD.FUNC.CALL.MUST Result of function that may return NULL will be passed to another function that may dereference it NPD.FUNC.MIGHT Result of function that can return NULL may be dereferenced NPD.FUNC.MUST Result of function that may return NULL will be dereferenced NPD.GEN.CALL.MIGHT Null pointer may be passed to function that may dereference it NPD.GEN.CALL.MUST Null pointer will be passed to function that may dereference it NPD.GEN.MIGHT Null pointer may be dereferenced NPD.GEN.MUST Null pointer will be dereferenced RNPD.CALL Suspicious dereference of pointer in function call before NULL check RNPD.DEREF Suspicious dereference of pointer before NULL check
FIO00-C	SV.FMT_STR.PRINT_FORMAT_MISMATCH.BAD Incompatible type of a print function parameter SV.FMT_STR.PRINT_FORMAT_MISMATCH.UNDESIRED Unexpected type of a print function parameter SV.FMT_STR.PRINT_IMPROP_LENGTH Improper use of length modifier in a print function call SV.FMT_STR.PRINT_PARAMS_WRONGNUM.FEW Too few arguments in a print function call SV.FMT_STR.PRINT_PARAMS_WRONGNUM.MANY Too many arguments in a print function call SV.FMT_STR.UNKWN_FORMAT Unknown format specifier in a print function call
FIO01-C	SV.TOCTOU.FILE_ACCESS Time of Creation/Time of Use Race condition in File Access
FIO02-C	SV.DLLPRELOAD.NONABSOLUTE.DLL Loading File without Use of Absolute Path
FIO30-C	SV.FMTSTR.GENERIC Format String Vulnerability SV.TAINTED.FMTSTR Use of Unvalidated Data in a Format String
FIO42-C	RH.LEAK Resource leak
INT31-C	PRECISION.LOSS Loss of Precision PRECISION.LOSS.CALL Loss of Precision during function call
MEM30-C	UFM.DEREF.MIGHT memory (access) - possible UFM.DEREF.MUST Use of Freed Memory by Pointer UFM.RETURN.MIGHT Use of freed memory (return) - possible UFM.RETURN.MUST Use of Freed Memory on Return UFM.USE.MIGHT Use of Freed Memory - possible UFM.USE.MUST Use of Freed Memory
MEM31-C	MLK.MIGHT Memory Leak - possible MLK.MUST Memory Leak UFM.FFM.MIGHT Use of Freed Memory (double free) - possible UFM.FFM.MUST Freeing Freed Memory
MEM34-C	FNH.MIGHT Freeing Non-Heap Memory - possible FNH.MUST Freeing Non-Heap Memory FUM.GEN.MIGHT Freeing Unallocated Memory - possible FUM.GEN.MUST Freeing Unallocated Memory
MEM39-CPP	FMM.MIGHT Freeing Mismatched Memory - possible FMM.MUST Freeing Mismatched Memory
MEM41-CPP	CL.FFM.ASSIGN Use of free memory (double free) - no operator= CL.FFM.COPY Use of free memory (double free) - no copy constructor CL.FMM Freeing Mismatched Memory - in destructor CL.MLK.VIRTUAL Memory Leak - possible in destructor
MEM42-CPP	CL.SELF-ASSIGN Memory Leak - in operator=
MSC01-C	LA_UNUSED Label unused
MSC07-C	UNREACH.GEN Unreachable code UNREACH.RETURN Unreachable return
MSC12-C	EFFECT Statement has no effect
MSC13-C	LV_UNUSED.GEN Local variable unused VA_UNUSED.GEN Value is Never Used after Assignment VA_UNUSED.INIT Value is Never Used after Initialization
POS33-C	SV.USAGERULES.PROCESS_VARIANTS Use of Dangerous Process Creation Function
POS36-C	SV.USAGERULES.PERMISSIONS Use of Dangerous Process Creation Function
POS37-C	SV.USAGERULES.PERMISSIONS Use of Dangerous Process Creation Function
STR02-C	NNTS.TAINTED Unvalidated User Input Causing Buffer Overflow - Non-Null Terminated String SV.TAINTED.INJECTION Command Injection
STR03-C	NNTS.MIGHT Buffer Overflow - Non-null Terminated String NNTS.MUST Buffer Overflow - Non-null Terminated String
STR31-C	NNTS.MIGHT Buffer Overflow - Non-null Terminated String NNTS.MUST Buffer Overflow - Non-null Terminated String SV.STRBO.BOUND_COPY Buffer Overflow in Bound String Copy SV.STRBO.BOUND_SPRINTF Buffer Overflow in Bound sprintf SV.STRBO.UNBOUND_COPY Buffer Overflow in Unbound String Copy SV.STRBO.UNBOUND_SPRINTF Buffer Overflow in Unbound sprintf
STR32-C	NNTS.MIGHT Buffer Overflow - Non-null Terminated String NNTS.MUST Buffer Overflow - Non-null Terminated String
STR33-C	SV.FMT_STR.BAD_SCAN_FORMAT Input format specifier error
STR35-C	NNTS.MIGHT Buffer Overflow - Non-null Terminated String NNTS.TAINTED Unvalidated User Input Causing Buffer Overflow - Non-Null Terminated String