Mapping Between CWE-658 or CWE-659 and Polyspace Bug Finder Defect Checkers

CWE™-658 and CWE-659 are a set of weaknesses specific to C and C++. The weaknesses enumerated in these subsets can be detected by using Polyspace^® Bug Finder™ defect checkers and mapped to these CWE rules.

CWE-658: Weaknesses in Software Written in C

CWE-658 is a subset of common weaknesses found specifically in C programs. See CWE-658.

The following table lists the CWE rules from this subset that are addressed by Polyspace Bug Finder defects, with corresponding defect checkers.

CWE ID	Description	Polyspace Bug Finder Defect Checker Short Name
14	Compiler Removal of Code to Clear Buffers	UNCERTAIN_MEMORY_CLEANING
119	Improper Restriction of Operations within the Bounds of a Memory Buffer	DANGEROUS_STD_FUNC DATA_LENGTH_MISMATCH INDETERMINATE_STRING MEM_STD_LIB MISSING_NULL_CHAR OTHER_STD_LIB OUT_BOUND_ARRAY OUT_BOUND_PTR SIZEOF_MISUSE STRLIB_BUFFER_OVERFLOW STRLIB_BUFFER_UNDERFLOW STR_FORMAT_BUFFER_OVERFLOW STR_STD_LIB TAINTED_ARRAY_INDEX TAINTED_PTR_OFFSET TAINTED_STRING
120	Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')	DANGEROUS_STD_FUNC MEM_STD_LIB STRLIB_BUFFER_OVERFLOW STR_STD_LIB TAINTED_STRING
121	Stack-based Buffer Overflow	DANGEROUS_STD_FUNC MEM_STD_LIB STRLIB_BUFFER_OVERFLOW STR_STD_LIB TAINTED_ARRAY_INDEX
122	Heap-based Buffer Overflow	DANGEROUS_STD_FUNC STRLIB_BUFFER_OVERFLOW TAINTED_PTR_OFFSET
123	Write-what-where Condition	DANGEROUS_STD_FUNC MEM_STD_LIB TAINTED_ARRAY_INDEX TAINTED_PTR_OFFSET TAINTED_STRING
124	Buffer Underwrite ('Buffer Underflow')	STRLIB_BUFFER_UNDERFLOW TAINTED_ARRAY_INDEX TAINTED_PTR_OFFSET
125	Out-of-bounds Read	CONTAINER_STD_LIB DANGEROUS_STD_FUNC MEM_STD_LIB MISSING_NULL_CHAR OUT_BOUND_ARRAY OUT_BOUND_PTR SIZEOF_MISUSE STRLIB_BUFFER_OVERFLOW STRLIB_BUFFER_UNDERFLOW STR_FORMAT_BUFFER_OVERFLOW STR_STD_LIB TAINTED_ARRAY_INDEX TAINTED_PTR_OFFSET TAINTED_STRING
126	Buffer Over-read	STR_FORMAT_BUFFER_OVERFLOW
127	Buffer Under-read	STR_FORMAT_BUFFER_OVERFLOW
128	Wrap-around Error	INT_CONSTANT_OVFL INT_CONV_OVFL INT_OVFL TAINTED_SIGN_CHANGE UINT_CONSTANT_OVFL UINT_CONV_OVFL UINT_OVFL
129	Improper Validation of Array Index	STR_STD_LIB TAINTED_ARRAY_INDEX TAINTED_INT_DIVISION TAINTED_INT_MOD TAINTED_PTR_OFFSET
130	Improper Handling of Length Parameter Inconsistency	DATA_LENGTH_MISMATCH
131	Incorrect Calculation of Buffer Size	OUT_BOUND_ARRAY OUT_BOUND_PTR PTR_SIZEOF_MISMATCH TAINTED_MEMORY_ALLOC_SIZE TAINTED_SIGN_CHANGE TAINTED_VLA_SIZE
134	Use of Externally-Controlled Format String	STRING_FORMAT TAINTED_STRING_FORMAT
135	Incorrect Calculation of Multi-Byte String Length	NARROW_WIDE_STR_MISUSE PTR_CAST STRLIB_BUFFER_OVERFLOW
170	Improper Null Termination	MISSING_NULL_CHAR READLINK_MISUSE STR_STD_LIB TAINTED_STRING
188	Reliance on Data/Memory Layout	INVALID_MEMORY_ASSUMPTION MEMCMP_PADDING_DATA MISSING_BYTESWAP
190	Integer Overflow or Wraparound	INT_CONSTANT_OVFL INT_CONV_OVFL INT_OVFL INT_PRECISION_EXCEEDED SHIFT_OVFL TAINTED_MEMORY_ALLOC_SIZE UINT_CONSTANT_OVFL UINT_CONV_OVFL UINT_OVFL
191	Integer Underflow (Wrap or Wraparound)	INT_CONSTANT_OVFL INT_OVFL UINT_CONSTANT_OVFL UINT_CONV_OVFL UINT_OVFL
192	Integer Coercion Error	INT_CONV_OVFL SIGN_CHANGE TAINTED_SIGN_CHANGE UINT_CONV_OVFL
193	Off-by-one Error	DANGEROUS_STD_FUNC OUT_BOUND_ARRAY
194	Unexpected Sign Extension	SIGN_CHANGE TAINTED_SIGN_CHANGE
195	Signed to Unsigned Conversion Error	SIGN_CHANGE TAINTED_SIGN_CHANGE
196	Unsigned to Signed Conversion Error	SIGN_CHANGE
197	Numeric Truncation Error	FLOAT_CONV_OVFL INT_CONV_OVFL MEMSET_INVALID_VALUE SIGN_CHANGE TAINTED_SIGN_CHANGE UINT_CONV_OVFL
242	Use of Inherently Dangerous Function	DANGEROUS_STD_FUNC OBSOLETE_STD_FUNC
243	Creation of chroot Jail Without Changing Working Directory	CHROOT_MISUSE
244	Improper Clearing of Heap Memory Before Release ('Heap Inspection')	SENSITIVE_HEAP_NOT_CLEARED
248	Uncaught Exception	UNCAUGHT_EXCEPTION
362	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')	FILE_EXPOSURE_TO_CHILD
364	Signal Handler Race Condition	SIG_HANDLER_ASYNC_UNSAFE SIG_HANDLER_ASYNC_UNSAFE_STRICT SIG_HANDLER_SHARED_OBJECT
366	Race Condition within a Thread	ATOMIC_VAR_ACCESS_TWICE ATOMIC_VAR_SEQUENCE_NOT_ATOMIC DATA_RACE DATA_RACE_BIT_FIELDS DATA_RACE_STD_LIB
375	Returning a Mutable Object to an Untrusted Caller	BREAKING_DATA_ENCAPSULATION
396	Declaration of Catch for Generic Exception	CATCH_FOR_GENERIC_EXCEPTION
397	Declaration of Throws for Generic Exception	THROW_FOR_GENERIC_EXCEPTION
401	Missing Release of Memory after Effective Lifetime	MEM_LEAK THREAD_MEM_LEAK
403	Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')	MISSING_PRIVILEGE_DROP_CHECK RESOURCE_LEAK
415	Double Free	DOUBLE_DEALLOCATION
416	Use After Free	FREED_PTR
457	Use of Uninitialized Variable	NON_INIT_MEMBER NON_INIT_PTR NON_INIT_VAR
463	Deletion of Data Structure Sentinel	MISSING_NULL_CHAR
464	Addition of Data Structure Sentinel	UNSAFE_STR_TO_NUMERIC
466	Return of Pointer Value Outside of Expected Range	OUT_BOUND_ARRAY OUT_BOUND_PTR
467	Use of sizeof() on a Pointer Type	PTR_SIZEOF_MISMATCH SIZEOF_MISUSE
468	Incorrect Pointer Scaling	BAD_PTR_SCALING OUT_BOUND_ARRAY OUT_BOUND_PTR PTR_TO_DIFF_ARRAY
469	Use of Pointer Subtraction to Determine Size	PTR_TO_DIFF_ARRAY
474	Use of Function with Inconsistent Implementations	OBSOLETE_STD_FUNC SIG_HANDLER_CALLING_SIGNAL
476	NULL Pointer Dereference	NULL_PTR
478	Missing Default Case in Multiple Condition Expression	MISSING_SWITCH_CASE
479	Signal Handler Use of a Non-reentrant Function	SIG_HANDLER_ASYNC_UNSAFE SIG_HANDLER_ASYNC_UNSAFE_STRICT
480	Use of Incorrect Operator	BAD_EQUAL_EQUAL_USE BAD_EQUAL_USE
481	Assigning instead of Comparing	BAD_EQUAL_USE
482	Comparing instead of Assigning	BAD_EQUAL_EQUAL_USE
483	Incorrect Block Delimitation	INCORRECT_INDENTATION SEMICOLON_CTRL_STMT_SAME_LINE
484	Omitted Break Statement in Switch	MISSING_SWITCH_BREAK
500	Public Static Field Not Marked Final	PUBLIC_STATIC_FIELD_NOT_CONST
558	Use of getlogin() in Multithreaded Application	UNSAFE_STD_FUNC
560	Use of umask() with chmod-style Argument	BAD_UMASK
562	Return of Stack Variable Address	LOCAL_ADDR_ESCAPE
587	Assignment of a Fixed Address to a Pointer	FUNC_PTR_ABSOLUTE_ADDR
676	Use of Potentially Dangerous Function	DANGEROUS_STD_FUNC DATA_RACE_STD_LIB STRLIB_BUFFER_OVERFLOW STR_FORMAT_BUFFER_OVERFLOW UNSAFE_STR_TO_NUMERIC UNSAFE_SYSTEM_CALL
681	Incorrect Conversion between Numeric Types	FLOAT_CONV_OVFL INT_TO_FLOAT_PRECISION_LOSS
685	Function Call With Incorrect Number of Arguments	FUNC_CAST STRING_FORMAT TOO_MANY_VA_ARG_CALLS
690	Unchecked Return Value to NULL Pointer Dereference	RETURN_NOT_CHECKED TAINTED_STRING UNPROTECTED_MEMORY_ALLOCATION
704	Incorrect Type Conversion or Cast	BAD_INT_PTR_CAST CHARACTER_MISUSE CHAR_EOF_CONFUSED INT_CONV_OVFL INT_TO_FLOAT_PRECISION_LOSS OBJECT_SIZE_MISMATCH PTR_CAST QUALIFIER_MISMATCH SIGN_CHANGE TAINTED_SIGN_CHANGE UINT_CONV_OVFL
733	Compiler Optimization Removal or Modification of Security-critical Code	UNCERTAIN_MEMORY_CLEANING
762	Mismatched Memory Management Routines	BAD_FREE WIN_MISMATCH_DEALLOC
763	Release of Invalid Pointer or Reference	BAD_FREE
766	Critical Data Element Declared Public	CRITICAL_DATA_MEMBER_DECLARED_PUBLIC
767	Access to Critical Private Variable via Public Method	BREAKING_DATA_ENCAPSULATION
783	Operator Precedence Logic Error	OPERATOR_PRECEDENCE
785	Use of Path Manipulation Function without Maximum-sized Buffer	PATH_BUFFER_OVERFLOW
786	Access of Memory Location Before Start of Buffer	STRLIB_BUFFER_UNDERFLOW
787	Out-of-bounds Write	STRLIB_BUFFER_OVERFLOW STRLIB_BUFFER_UNDERFLOW
788	Access of Memory Location After End of Buffer	DANGEROUS_STD_FUNC DATA_LENGTH_MISMATCH MEM_STD_LIB OTHER_STD_LIB OUT_BOUND_ARRAY OUT_BOUND_PTR STRLIB_BUFFER_OVERFLOW STRLIB_BUFFER_UNDERFLOW STR_FORMAT_BUFFER_OVERFLOW STR_STD_LIB TAINTED_ARRAY_INDEX TAINTED_PTR_OFFSET TAINTED_SIGN_CHANGE
789	Memory Allocation with Excessive Size Value	PTR_SIZEOF_MISMATCH TAINTED_MEMORY_ALLOC_SIZE TAINTED_VLA_SIZE
805	Buffer Access with Incorrect Length Value	DATA_LENGTH_MISMATCH MEM_STD_LIB OTHER_STD_LIB SIZEOF_MISUSE STRLIB_BUFFER_OVERFLOW STRLIB_BUFFER_UNDERFLOW STR_FORMAT_BUFFER_OVERFLOW STR_STD_LIB
806	Buffer Access Using Size of Source Buffer	STRLIB_BUFFER_OVERFLOW STR_STD_LIB
824	Access of Uninitialized Pointer	NON_INIT_PTR
825	Expired Pointer Dereference	DOUBLE_DEALLOCATION FREED_PTR INVALID_ENV_POINTER LOCAL_ADDR_ESCAPE PUTENV_AUTO_VAR TEMP_OBJECT_ACCESS
839	Numeric Range Comparison Without Minimum Check	TAINTED_PTR_OFFSET TAINTED_SIGN_CHANGE
910	Use of Expired File Descriptor	CLOSED_RESOURCE_USE
911	Improper Update of Reference Count	FREED_PTR
1335	Incorrect Bitwise Shift of Integer	SHIFT_NEG SHIFT_OVFL
1341	Multiple Releases of Same Resource or Handle	DOUBLE_RESOURCE_CLOSE

CWE-659: Weaknesses in Software Written in C++

CWE-659 is a subset of common weaknesses found specifically in C++ programs. See CWE-659.

The following table lists the CWE rules from this subset that are addressed by Polyspace Bug Finder defects, with corresponding defect checkers.

CWE ID	Description	Polyspace Bug Finder Defect Checker Short Name
119	Improper restriction of operations within the bounds of a memory buffer	DANGEROUS_STD_FUNC DATA_LENGTH_MISMATCH INDETERMINATE_STRING MEM_STD_LIB MISSING_NULL_CHAR OTHER_STD_LIB OUT_BOUND_ARRAY OUT_BOUND_PTR SIZEOF_MISUSE STRLIB_BUFFER_OVERFLOW STRLIB_BUFFER_UNDERFLOW STR_FORMAT_BUFFER_OVERFLOW STR_STD_LIB TAINTED_ARRAY_INDEX TAINTED_PTR_OFFSET TAINTED_STRING
120	Buffer copy without checking size of input ('Classic buffer overflow')	DANGEROUS_STD_FUNC MEM_STD_LIB STRLIB_BUFFER_OVERFLOW STR_STD_LIB TAINTED_STRING
121	Stack-based buffer overflow	DANGEROUS_STD_FUNC MEM_STD_LIB STRLIB_BUFFER_OVERFLOW STR_STD_LIB TAINTED_ARRAY_INDEX
122	Heap-based buffer overflow	DANGEROUS_STD_FUNC STRLIB_BUFFER_OVERFLOW TAINTED_PTR_OFFSET
124	Buffer underwrite ('Buffer underflow')	STRLIB_BUFFER_UNDERFLOW TAINTED_ARRAY_INDEX TAINTED_PTR_OFFSET
125	Out-of-bounds read	CONTAINER_STD_LIB DANGEROUS_STD_FUNC MEM_STD_LIB MISSING_NULL_CHAR OUT_BOUND_ARRAY OUT_BOUND_PTR SIZEOF_MISUSE STRLIB_BUFFER_OVERFLOW STRLIB_BUFFER_UNDERFLOW STR_FORMAT_BUFFER_OVERFLOW STR_STD_LIB TAINTED_ARRAY_INDEX TAINTED_PTR_OFFSET TAINTED_STRING
126	Buffer over-read	STR_FORMAT_BUFFER_OVERFLOW
127	Buffer under-read	STR_FORMAT_BUFFER_OVERFLOW
128	Wrap-around error	INT_CONSTANT_OVFL INT_CONV_OVFL INT_OVFL TAINTED_SIGN_CHANGE UINT_CONSTANT_OVFL UINT_CONV_OVFL UINT_OVFL
129	Improper validation of array index	STR_STD_LIB TAINTED_ARRAY_INDEX TAINTED_INT_DIVISION TAINTED_INT_MOD TAINTED_PTR_OFFSET
130	Improper handling of length parameter inconsistency	DATA_LENGTH_MISMATCH
131	Incorrect calculation of buffer size	OUT_BOUND_ARRAY OUT_BOUND_PTR PTR_SIZEOF_MISMATCH TAINTED_MEMORY_ALLOC_SIZE TAINTED_SIGN_CHANGE TAINTED_VLA_SIZE
134	Use of Externally-Controlled Format String	STRING_FORMAT TAINTED_STRING_FORMAT
135	Incorrect Calculation of Multi-Byte String Length	NARROW_WIDE_STR_MISUSE PTR_CAST STRLIB_BUFFER_OVERFLOW
170	Improper null termination	MISSING_NULL_CHAR READLINK_MISUSE STR_STD_LIB TAINTED_STRING
188	Reliance on data/memory layout	INVALID_MEMORY_ASSUMPTION MEMCMP_PADDING_DATA MISSING_BYTESWAP
191	Integer underflow (Wrap or wraparound)	INT_CONSTANT_OVFL INT_OVFL UINT_CONSTANT_OVFL UINT_CONV_OVFL UINT_OVFL
192	Integer coercion error	INT_CONV_OVFL SIGN_CHANGE TAINTED_SIGN_CHANGE UINT_CONV_OVFL
194	Unexpected sign extension	SIGN_CHANGE TAINTED_SIGN_CHANGE
195	Signed to unsigned conversion error	SIGN_CHANGE TAINTED_SIGN_CHANGE
196	Unsigned to signed conversion error	SIGN_CHANGE
197	Numeric truncation error	FLOAT_CONV_OVFL INT_CONV_OVFL MEMSET_INVALID_VALUE SIGN_CHANGE TAINTED_SIGN_CHANGE UINT_CONV_OVFL
242	Use of inherently dangerous function	DANGEROUS_STD_FUNC OBSOLETE_STD_FUNC
243	Creation of chroot jail without changing working directory	CHROOT_MISUSE
244	Improper Clearing of Heap Memory Before Release ('Heap Inspection')	SENSITIVE_HEAP_NOT_CLEARED
362	Concurrent execution using shared resource with improper synchronization ('Race Condition')	FILE_EXPOSURE_TO_CHILD
364	Signal handler race condition	SIG_HANDLER_ASYNC_UNSAFE SIG_HANDLER_ASYNC_UNSAFE_STRICT SIG_HANDLER_SHARED_OBJECT
366	Race condition within a thread	ATOMIC_VAR_ACCESS_TWICE ATOMIC_VAR_SEQUENCE_NOT_ATOMIC DATA_RACE DATA_RACE_BIT_FIELDS DATA_RACE_STD_LIB
375	Returning a mutable object to an untrusted caller	BREAKING_DATA_ENCAPSULATION
401	Missing Release of Memory after Effective Lifetime	MEM_LEAK THREAD_MEM_LEAK
415	Double free	DOUBLE_DEALLOCATION
416	Use after free	FREED_PTR
457	Use of uninitialized variable	NON_INIT_MEMBER NON_INIT_PTR NON_INIT_VAR
466	Return of pointer value outside of expected range	OUT_BOUND_ARRAY OUT_BOUND_PTR
467	Use of sizeof() on a pointer type	PTR_SIZEOF_MISMATCH SIZEOF_MISUSE
468	Incorrect pointer scaling	BAD_PTR_SCALING OUT_BOUND_ARRAY OUT_BOUND_PTR PTR_TO_DIFF_ARRAY
469	Use of pointer subtraction to determine size	PTR_TO_DIFF_ARRAY
476	NULL pointer dereference	NULL_PTR
478	Missing Default Case in Multiple Condition Expression	MISSING_SWITCH_CASE
479	Signal handler use of a non-reentrant function	SIG_HANDLER_ASYNC_UNSAFE SIG_HANDLER_ASYNC_UNSAFE_STRICT
480	Use of incorrect operator	BAD_EQUAL_EQUAL_USE BAD_EQUAL_USE
481	Assigning instead of comparing	BAD_EQUAL_USE
482	Comparing instead of assigning	BAD_EQUAL_EQUAL_USE
483	Incorrect block delimitation	INCORRECT_INDENTATION SEMICOLON_CTRL_STMT_SAME_LINE
484	Omitted break statement in switch	MISSING_SWITCH_BREAK
558	Use of getlogin() in multithreaded application	UNSAFE_STD_FUNC
562	Return of stack variable address	LOCAL_ADDR_ESCAPE
587	Assignment of a fixed address to a pointer	FUNC_PTR_ABSOLUTE_ADDR
676	Use of potentially dangerous function	DANGEROUS_STD_FUNC DATA_RACE_STD_LIB STRLIB_BUFFER_OVERFLOW STR_FORMAT_BUFFER_OVERFLOW UNSAFE_STR_TO_NUMERIC UNSAFE_SYSTEM_CALL
690	Unchecked return value to null pointer dereference	RETURN_NOT_CHECKED TAINTED_STRING UNPROTECTED_MEMORY_ALLOCATION
704	Incorrect type conversion or cast	BAD_INT_PTR_CAST CHARACTER_MISUSE CHAR_EOF_CONFUSED INT_CONV_OVFL INT_TO_FLOAT_PRECISION_LOSS OBJECT_SIZE_MISMATCH PTR_CAST QUALIFIER_MISMATCH SIGN_CHANGE TAINTED_SIGN_CHANGE UINT_CONV_OVFL
762	Mismatched memory management routines	BAD_FREE WIN_MISMATCH_DEALLOC
767	Access to critical private variable via public method	BREAKING_DATA_ENCAPSULATION
783	Operator precedence logic error	OPERATOR_PRECEDENCE
785	Use of path manipulation function without maximum-sized buffer	PATH_BUFFER_OVERFLOW
787	Out-of-bounds write	STRLIB_BUFFER_OVERFLOW STRLIB_BUFFER_UNDERFLOW
789	Memory Allocation with Excessive Size Value	PTR_SIZEOF_MISMATCH TAINTED_MEMORY_ALLOC_SIZE TAINTED_VLA_SIZE
805	Buffer access with incorrect length value	DATA_LENGTH_MISMATCH MEM_STD_LIB OTHER_STD_LIB SIZEOF_MISUSE STRLIB_BUFFER_OVERFLOW STRLIB_BUFFER_UNDERFLOW STR_FORMAT_BUFFER_OVERFLOW STR_STD_LIB
910	Use of expired file descriptor	CLOSED_RESOURCE_USE