4 ms·

Can C code be linted according to those rules? I wonder if that kind of coding standards can be part of ISO standards.

by jokoon 12y ago

EliRivers 12y ago
I do some work in the static analysis industry, and it's common to see analyses based on various coding standards, including this one.
pjmlp 12y ago
Yes, but it is above all a culture problem. Many developers think that they don't need static analyzers. Actually lint was part of the original UNIX, but since it took some effort to configure and not everyone agreed with the rules, it was seldom ported to other systems, and it became part of the C culture not to use it. I think we have to thank the LLVM project that now static analyzers are welcome in C.
BudVVeezer 12y ago
It can, and it is. One of the outcomes of the CERT C secure coding standard was the publication of TS 17961, which is an ISO document on C analyzability, which also went hand in hand with the Annex L (normative) section of the C standard. Basically, the CERT rules all must be analyzable (though some require dynamic analysis instead of static analysis).
rcseacord 12y ago
We did actually produce ISO/IEC TS 17961:2013 Information technology -- Programming languages, their environments and system software interfaces -- C secure coding rules http://www.iso.org/iso/catalogue_detail.htm?csnumber=61134 http://www.iso.org/iso/catalogue_detail.htm?csnumber=61134 The rules specified in this Technical Specification apply to analyzers, including static analysis tools and C language compiler vendors that wish to diagnose insecure code beyond the requirements of the language standard. All rules are meant to be enforceable by static analysis. I wrote an article putting all this in some context at: http://www.informit.com/articles/article.aspx?p=2088511 http://www.informit.com/articles/article.aspx?p=2088511

4 ms·

Can C code be linted according to those rules? I wonder if that kind of coding standards can be part of ISO standards.

by jokoon 12y ago

Can C code be linted according to those rules? I wonder if that kind of coding standards can be part of ISO standards.

EliRivers 12y ago
I do some work in the static analysis industry, and it's common to see analyses based on various coding standards, including this one.
pjmlp 12y ago
Yes, but it is above all a culture problem. Many developers think that they don't need static analyzers. Actually lint was part of the original UNIX, but since it took some effort to configure and not everyone agreed with the rules, it was seldom ported to other systems, and it became part of the C culture not to use it. I think we have to thank the LLVM project that now static analyzers are welcome in C.
BudVVeezer 12y ago
It can, and it is. One of the outcomes of the CERT C secure coding standard was the publication of TS 17961, which is an ISO document on C analyzability, which also went hand in hand with the Annex L (normative) section of the C standard. Basically, the CERT rules all must be analyzable (though some require dynamic analysis instead of static analysis).
rcseacord 12y ago
We did actually produce ISO/IEC TS 17961:2013 Information technology -- Programming languages, their environments and system software interfaces -- C secure coding rules http://www.iso.org/iso/catalogue_detail.htm?csnumber=61134 http://www.iso.org/iso/catalogue_detail.htm?csnumber=61134 The rules specified in this Technical Specification apply to analyzers, including static analysis tools and C language compiler vendors that wish to diagnose insecure code beyond the requirements of the language standard. All rules are meant to be enforceable by static analysis. I wrote an article putting all this in some context at: http://www.informit.com/articles/article.aspx?p=2088511 http://www.informit.com/articles/article.aspx?p=2088511