Qiita Teams that are logged in
You are not logged in to any team

Log in to Qiita Team
Community
OrganizationEventAdvent CalendarQiitadon (β)
Service
Qiita JobsQiita ZineQiita Blog
1
Help us understand the problem. What are the problem?

More than 3 years have passed since last update.

posted at

updated at

CERT CPP入門(1) Rule 01. Declarations and Initialization (DCL)

CERT CPP

CERT CPPを道具としてうまく使いこなせるようになるまでの道を記述します。
CERT CPP
https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=88046682
は、Security用のC++言語コーディング標準です。
MISRA C++などのコーディング標準、道具類、規格類をまとめて、実践的に対応しています。
CERT CPPは、頻繁に構造が変わることがあリます。ここに記載したURLは、2018年3月22日(水)現在のものです。URLが繋がらなければ、見出しの文字で検索してください。
現在、11分類です。QiitaのURLは現在作業しているものdす。

Rule 01. Declarations and Initialization (DCL)

Rule 02. Expressions (EXP)

Rule 03. Integers (INT)

Rule 04. Containers (CTR)

Rule 05. Characters and Strings (STR)

Rule 06. Memory Management (MEM)

Rule 07. Input Output (FIO)

Rule 08. Exceptions and Error Handling (ERR)

Rule 09. Object Oriented Programming (OOP)

Rule 10. Concurrency (CON)

Rule 49. Miscellaneous (MSC)

Rule 01. Declarations and Initialization (DCL)

DCL50-CPP. Do not define a C-style variadic function

dcl50非適合例

dcl50n.cpp
// (c)CERT C++
// Rule 01. Declarations and Initialization (DCL)
// DCL50-CPP. Do not define a C-style variadic function
// https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=88046682
// Non Compliant Example: dcl50n.cpp
// Compile: Dr. Kiyoshi Ogawa
// tool: clang version 6.0.0 (tags/RELEASE_600/final)
//       g++-7 (Homebrew GCC 7.3.0_1) 7.3.0
// command: ./certcpp.sh dlc50n
#include <stdio.h>
#include <cstdarg>

int add(int first, int second, ...) {
  int r = first + second; 
  va_list va;
  va_start(va, second);
  while (int v = va_arg(va, int)) {
    r += v;
  }
  va_end(va);
  return r;
}  

int main(int argc, char**argv) {
  int i=1;
  i=add(argc, i);
  printf("%d \n",i);
  return argc;
}
$./certcpp.sh dlc50n
clang++ dlc50n.cpp
In file included from dlc50n.cpp:1:
/usr/local/Cellar/llvm/5.0.1/include/c++/v1/stdio.h:108:15: fatal error: 'stdio.h' file not found
#include_next <stdio.h>
              ^~~~~~~~~
1 error generated.
./certcpp.sh: line 4: ./dlc50nl: No such file or directory
g++-7 dlc50n.cpp
-478885725 

CじゃなくC++。stdio.hはC

dcl50n2.cpp
// (c)CERT C++
#define Rule "Rule 01. Declarations and Initialization (DCL)"
#define SubRule  "DCL50-CPP. Do not define a C-style variadic function"
// https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=88046682
// Non Compliant Example: dcl50n2.cpp(rewriting of dcl50n.cpp)
// Compile: Dr. Kiyoshi Ogawa
// Tool: clang version 6.0.0 (tags/RELEASE_600/final)
//       g++-7 (Homebrew GCC 7.3.0_1) 7.3.0
// Command: ./certcpp.sh dlc50n2
#include <iostream>
#include <cstdarg>

int add(int first, int second, ...) {
  int r = first + second; 
  va_list va;
  va_start(va, second);
  while (int v = va_arg(va, int)) {
    r += v;
  }
  va_end(va);
  return r;
}  

int main(int argc, char**argv) {
  int i=1;
  i=add(argc, i);
  std::cout << i << std::endl;
  std::cout << Rule << std::endl << SubRule << std::endl;
  return argc;
}

使ったシェルスクリプトは
コンパイル用shell script C版(clangとgcc)とC++版(clang++とg++)
https://qiita.com/kaizen_nagoya/items/74220c0577a512c2d7da

./certcpp.sh dcl50n
clang++ dcl50n.cpp
In file included from dlc50n.cpp:1:
In file included from /usr/local/Cellar/llvm/6.0.0/include/c++/v1/iostream:38:
In file included from /usr/local/Cellar/llvm/6.0.0/include/c++/v1/ios:215:
In file included from /usr/local/Cellar/llvm/6.0.0/include/c++/v1/iosfwd:90:
/usr/local/Cellar/llvm/6.0.0/include/c++/v1/wchar.h:119:15: fatal error: 'wchar.h' file not found
#include_next <wchar.h>
              ^~~~~~~~~
1 error generated.
./certcpp.sh: line 4: ./dlc50nl: No such file or directory
g+-6 dlc50n.cpp
-436418389

'wchar.h' file not found で困った clang++ macOS
https://qiita.com/kaizen_nagoya/items/de15cd46d657517fac11
上記でエラーを解消した。

$ ./certcpp.sh dcl50n2
clang++ dcl50n2.cpp
-998144006
Rule 01. Declarations and Initialization (DCL)
DCL50-CPP. Do not define a C-style variadic function
g++-7 dcl50n2.cpp
-471100309
Rule 01. Declarations and Initialization (DCL)
DCL50-CPP. Do not define a C-style variadic function

参考文献

全体を一つのファイルでコンパイルしようとした例はこちら。
DCL50-CPP. Do not define a C-style variadic function
https://researchmap.jp/jog1j55sp-1797580/#_1797580

C Puzzle Bookの有り難み5つ、C言語規格及びCコンパイラの特性を認識
https://qiita.com/kaizen_nagoya/items/d89a48c1536a02ecdec9

MISRA C まとめ #include
https://qiita.com/kaizen_nagoya/items/f1a79a7cbd281607c7c9

[C][C++]の国際規格案の例題をコンパイルするときの課題7つ。
https://qiita.com/kaizen_nagoya/items/5f4b155030259497c4de

SWESTまとめ C言語規格の断片をコンパイルすることの重要性はSWESTでもなんども推奨している。
https://qiita.com/drafts/62e56ae151554d6200c0

プログラミング言語が設計書である3つの理由
https://qiita.com/kaizen_nagoya/items/34daa0403eaca5e8b5a6

参考文献

CERT C++ Secure Coding Guidelines, By David Svoboda
https://insights.sei.cmu.edu/sei_blog/2017/04/cert-c-secure-coding-guidelines.html

文書履歴

ver 0.10 初稿 201803

Why not register and get more from Qiita?
  1. We will deliver articles that match you
    By following users and tags, you can catch up information on technical fields that you are interested in as a whole
  2. you can read useful information later efficiently
    By "stocking" the articles you like, you can search right away
1
Help us understand the problem. What are the problem?