CERT C Compliance with TrustInSoft Analyzer

The CERT C standard comprises a comprehensive set of rules aimed at enhancing the safety and security of C programs. Key guidelines focus on areas such as dynamic memory management, integer operations, input validation, and proper handling of concurrency, which are often sources of vulnerabilities. 

Notable guidelines include avoiding buffer overflow, preventing integer overflows, and ensuring the correct use of synchronization primitives to avoid deadlocks and race conditions. These rules are documented by the CERT Coordination Center and are continuously updated to address new and emerging threats in software development. 

CERT C targets specific, common errors in C programming that lead to security vulnerabilities and software instability. By providing detailed explanations and remediation steps for issues such as buffer overflows, use-after-free errors, and improper type conversions, CERT C helps developers understand what to avoid and why.  

Each guideline includes examples that demonstrate non-compliant code and compliant solutions, making it easier for developers to apply the principles in real-world scenarios. This proactive approach helps drive best practices in coding and significantly reduces the risk of security breaches caused by exploitable code. 

The following example scenario is an illustration of a function that receives a string from user input and copies it into a local buffer. The non-compliant code results in a buffer overflow which is a common security vulnerability in C programming.  

Non-Compliant Code:

Issue: The `strcpy` function does not check the length of `userInput`. If `userInput` is longer than 49 characters, it will overflow `buffer`, leading to undefined behavior and potential security risks like stack smashing. 

Compliant Code: 

Resolution: By using `strncpy`, the function now limits the number of characters copied to `buffer` to one less than the size of `buffer`, leaving space for the null terminator. This prevents buffer overflow by ensuring that the data copied into `buffer` does not exceed its capacity. The explicit null termination after `strncpy` guarantees that `buffer`is a valid C-string, even if `userInput` is longer than the buffer size. 

CERT C promotes several secure coding practices that are fundamental to developing robust software.

• Resource Management: Always validate the size of buffers before writing to them and use functions known to limit writes, such as `strncpy()` instead of `strcpy()`. 
• Control of Operations: Use safe integer operations to prevent overflows and underflows, especially when dealing with external input. 
• Error Handling: Implement comprehensive error handling that doesn’t leak sensitive information and ensures the program can fail securely if unexpected conditions occur. 
• Concurrency: Utilize mutexes and other synchronization mechanisms to manage access to shared resources between threads, preventing race conditions and ensuring thread safety. 

These practices are not just about preventing errors but also about enhancing the maintainability and readability of code, which are crucial for long-term project sustainability. 

CERT C and MISRA C standards are both pivotal in fostering secure and reliable coding practices, yet they serve slightly different purposes tailored to their specific audiences.  

• CERT C focuses on improving the security aspects of C programming to prevent vulnerabilities that can be exploited in software applications. It offers guidelines aimed at reducing errors that lead to security breaches and software malfunctions.  
• MISRA C is more focused on reliability and portability, primarily used in the automotive industry where safety is paramount. MISRA C’s guidelines are aimed at ensuring that C code is highly reliable and can operate safely under constrained environments typical of embedded systems.  

CERT C’s scope is broader in terms of security, making it suitable for a wider range of applications beyond just embedded systems. 

The following comparative table illustrates the key differences between the CERT C and MISRA C coding standards.