HKMC C++ Secure Coding Standard for Automotive Development
| Rule | Checker name and description |
|---|---|
| HKMC P-CON-001 (Middle): Do not destroy a mutex while it is locked |
CERT.CONC.MUTEX.DESTROY_WHILE_LOCKED Do not destroy a mutex while it is locked |
| HKMC P-CON-002 (Middle): Ensure actively held locks are released on exceptional conditions |
CERT.CONC.LOCK.NO_RELEASE_ON_EXCEPTION Ensure actively held locks are released on exceptional conditions |
| HKMC P-CON-004 (Low): Prevent deadlock by locking mutex in predefined order |
CONC.DL Deadlock |
| HKMC P-CON-005 (Low): Wrap function that can wake up falsely in a loop |
CERT.CONC.WAKE_IN_LOOP Wrap functions that can spuriously wake up in a loop |
| HKMC P-CON-006 (Low): Protect thread safety and liveness when using condition variables |
CERT.CONC.UNSAFE_COND_VAR Preserve thread safety and liveness when using condition variables |
| HKMC P-CTR-001 (High): Guarantee that container indices and iterators are within the valid range |
ABV.ANY_SIZE_ARRAY Buffer Overflow - Array Index Out of Bounds ABV.GENERAL Buffer Overflow - Array Index Out of Bounds ABV.GENERAL.MULTIDIMENSION Buffer Overflow - Array Index Out of Bounds ABV.NON_ARRAY Non-array object is used as an array ABV.STACK Buffer Overflow - Local Array Index Out of Bounds ABV.TAINTED Buffer Overflow from Unvalidated Input SV.TAINTED.ALLOC_SIZE Use of Unvalidated Integer in Memory Allocation SV.TAINTED.CALL.INDEX_ACCESS Use of Unvalidated Integer as Array Index by Function Call SV.TAINTED.CALL.LOOP_BOUND Use of Unvalidated Integer in Loop Condition through a Function Call SV.TAINTED.INDEX_ACCESS Use of Unvalidated Integer as Array Index |
| HKMC P-CTR-002 (High): Do not use valid references, pointer, and iterators to reference element of a container |
ITER.CONTAINER.MODIFIED Use of invalid iterator |
| HKMC P-CTR-003 (High): Overflow protection required when copying data |
ITER.END.OUTPARAM.MIGHT Use of 'end' as an output iterator ITER.END.OUTPARAM.MUST Use of 'end' as an output iterator |
| HKMC P-CTR-004 (High): Use valid iterator ranges |
CXX.ITER.END.BEGIN Iterator representing end of the range precedes start of range ITER.INAPPROPRIATE Use of iterator with inappropriate container object ITER.INAPPROPRIATE.MULTIPLE Use of iterator with inappropriate container object ITER.RANGE.INVALID Use of invalid iterator range |
| HKMC P-CTR-006 (High): Do not use an additive operator on an iterator if the result would overflow |
ITER.ADVANCE.NONADJACENT Advancing iterator by a distance of more than 1 |
| HKMC P-CTR-007 (High): Do not use pointer arithmetic on polymorphic objects |
CERT.CTR.PTR_ARITH_POLYMORPHIC Do not use pointer arithmetic on polymorphic objects |
| HKMC P-DCL-001 (High): Do not define a C-style variadic function |
MISRA.FUNC.VARARG Function with variable number of arguments |
| HKMC P-DCL-002 (Low): Do not declare or define a reserved identifier |
MISRA.DEFINE.WRONGNAME Usage of a name from the standard library for naming a macro MISRA.DEFINE.WRONGNAME.UNDERSCORE Usage of a reserved name for naming a macro MISRA.STDLIB.WRONGNAME Reused name of standard library macro, object or function MISRA.STDLIB.WRONGNAME.UNDERSCORE Usage of a reserved name for naming a language entity MISRA.UNDEF.WRONGNAME Undefinition of a name from the standard library MISRA.UNDEF.WRONGNAME.UNDERSCORE Undefinition of a reserved name |
| HKMC P-DCL-003 (Low): Do not qualify a reference type with const or volatile |
CERT.DCL.REF_TYPE.CONST_OR_VOLATILE Never qualify a reference type with const or volatile |
| HKMC P-DCL-004 (Low): Do not write syntactically ambiguous declarations |
CERT.DCL.AMBIGUOUS_DECL Do not write syntactically ambiguous declarations |
| HKMC P-DCL-005 (Low): Overload allocation and deallocation functions as a pair in the same scope |
CERT.DCL.SAME_SCOPE_ALLOC_DEALLOC Overload allocation and deallocation functions as a pair in the same scope |
| HKMC P-DCL-006 (Low): Attention of data leaks when passing class objects across trust boundaries |
PORTING.STORAGE.STRUCT Byte position of elements in a structure could depend on alignment and packing attributes. |
| HKMC P-DCL-007 (Low): Do not reenter of function during initalization of static objects |
CXX.STATIC.OBJ.RECURSION Do not reenter function during initialization of static objects |
| HKMC P-DCL-008 (Low): Prevent termination due to exceptions in destructors or deallocation functions |
MISRA.DTOR.THROW Throw in destructor |
| HKMC P-DCL-009 (High): Do not modify the standard namespaces |
CERT.DCL.STD_NS_MODIFIED Do not modify the standard namespaces |
| HKMC P-DCL-010 (Middle): Do not define an unnamed namespace in a header file |
MISRA.NAMESPACE.UNMD Unnamed namespace in header file |
| HKMC P-DCL-011 (High): Compliance of ODR (One-Definition Rule) |
AUTOSAR.ADD.ONEDEFRULE.FUNC Function is violating one definition rule AUTOSAR.ADD.ONEDEFRULE.VAR Variable is violating one definition rule CERT.DCL.ODR.CLASS_REDEFINITION Obey the one-definition rule for classes and structs. MISRA.CT.UNIQUE.ID Identifier clashes with tag name MISRA.TYPE.NAMECLASH.CPP.2008 Identifier in one name space has same spelling as identifier in other name space MISRA.TYPEDEF.NOT_UNIQUE Typedef name is used for another entity |
| HKMC P-ERR-001 (Low): Do not abruptly terminate the program |
CERT.ERR.ABRUPT_TERM Do not abruptly terminate the program |
| HKMC P-ERR-003 (Low): Do not use setjmp() or longjum() |
MISRA.STDLIB.LONGJMP Use of setjmp macro or longjmp function |
| HKMC P-ERR-004 (Low): Do not reference base classes or class data members in a constructor or destructor function-try-block handler |
MISRA.CTOR.TRY.NON_STATIC Function try/catch block of constructor or destructor references non-static members |
| HKMC P-ERR-005 (Middle): Exception handling in order from lowest class to highest class |
MISRA.CATCH.NOALL Ellipsis exception handler is not the last one in a try-catch block MISRA.CATCH.WRONGORD Handler for a base exception class precedes to a handler for a derived exception class in a try-catch block |
| HKMC P-ERR-007 (High): Guarantee exception safety |
CERT.EXCEPTION.SAFETY.ASSIGN_ORDER Guarantee exception safety in assignment operators |
| HKMC P-ERR-008 (Low): Prevent to leak resources when handling exceptions |
CL.MLK Memory Leak - in destructor MLK.MIGHT Memory Leak - possible MLK.MUST Memory Leak MLK.RET.MIGHT Memory Leak - possible MLK.RET.MUST Memory Leak RH.LEAK Resource leak |
| HKMC P-ERR-009 (Low): Handle all exceptions before main() begins executing |
CERT.ERR.UNCAUGHT_STATIC_INIT Handle all exceptions thrown before main() begins executing |
| HKMC P-ERR-010 (Low): Catch exceptions by lvalue reference |
MISRA.CATCH.BY_VALUE Exception object of class type is caught by value |
| HKMC P-ERR-011 (Middle): Detect errors when converting a string to a number |
CERT.ERR.CONV.STR_TO_NUM Detect errors when converting a string to a number |
| HKMC P-EXP-001 (Middle): Attention to the order of evaluation that causes the side effects |
CERT.EXPR.PARENS The precedence of operators within expressions should be made explicit. MISRA.EXPR.PARENS.INSUFFICIENT Limited dependence required for operator precedence rules in expressions MISRA.INCR_DECR.OTHER Increment or decrement operator is mixed with other operators in expression MISRA.INCR_DECR.SIDEEFF.2012 A full expression containing an increment (++) or decrement (--) operator should have no other potential side effects other than that caused by the increment or decrement operator PORTING.VAR.EFFECTS Variable used twice in one expression where one usage is subject to side-effects |
| HKMC P-EXP-002 (Low): Do not delete an array through a pointer of the incorrect type |
CERT.EXPR.DELETE_ARR.BASE_PTR Do not delete an array through a pointer of the incorrect type |
| HKMC P-EXP-003 (Low): Attention to use expressions that do not evaluate(calculate) operands |
MISRA.SIZEOF.SIDE_EFFECT Operand of sizeof has side effects |
| HKMC P-EXP-004 (High): Do not reference memory before initialized |
UNINIT.CTOR.MIGHT Uninitialized Variable in Constructor - possible UNINIT.CTOR.MUST Uninitialized Variable in Constructor UNINIT.HEAP.MIGHT Uninitialized Heap Use - possible UNINIT.HEAP.MUST Uninitialized Heap Use UNINIT.STACK.ARRAY.MIGHT Uninitialized Array - possible UNINIT.STACK.ARRAY.MUST Uninitialized Array UNINIT.STACK.ARRAY.PARTIAL.MUST Partially Uninitialized Array UNINIT.STACK.MIGHT Uninitialized Variable - possible UNINIT.STACK.MUST Uninitialized Variable |
| HKMC P-EXP-005 (High): Do not access an object of its lifetime |
CL.FFM.ASSIGN Use of free memory (double free) - no operator= CL.FFM.COPY Use of free memory (double free) - no copy constructor LOCRET.ARG Function returns address of local variable LOCRET.GLOB Function returns address of local variable LOCRET.RET Function returns address of local variable UFM.DEREF.MIGHT Use of free memory (access) - possible UFM.DEREF.MUST Use of Freed Memory by Pointer UFM.FFM.MIGHT Use of free memory (double free) - possible UFM.FFM.MUST Freeing Freed Memory UFM.RETURN.MIGHT Use of freed memory (return) - possible UFM.RETURN.MUST Use of Freed Memory on Return UFM.USE.MIGHT Use of free memory - possible UFM.USE.MUST Use of Freed Memory UNINIT.HEAP.MIGHT Uninitialized Heap Use - possible UNINIT.HEAP.MUST Uninitialized Heap Use UNINIT.STACK.ARRAY.MIGHT Uninitialized Array - possible UNINIT.STACK.ARRAY.MUST Uninitialized Array UNINIT.STACK.ARRAY.PARTIAL.MUST Partially Uninitialized Array UNINIT.STACK.MIGHT Uninitialized Variable - possible UNINIT.STACK.MUST Uninitialized Variable |
| HKMC P-EXP-006 (Middle): Do not access a CV variable through a CV(const or volatile) unqualified variable |
MISRA.CAST.CONST Cast operation removes const or volatile modifier from a pointer or reference |
| HKMC P-EXP-007 (Middle): Calling va_start requires passing an object of the appropriate type |
CERT.VA_START.TYPE Pass an object of the correct type to va_start |
| HKMC P-EXP-010 (High): Do not access the bits that are part of the object's value |
CERT.MEMCMP.PADDED_DATA Do not compare padding data |
| HKMC P-EXP-011 (Middle): Do not rely on the value of moved from object |
CERT.EXPR.MOVED_FROM.RANGE Do not use a moved-from iterator object CERT.EXPR.MOVED_FROM.USE Do not use a moved-from object |
| HKMC P-FIO-002 (Middle): Close file pointers that are no longer needed |
RH.LEAK Resource leak |
| HKMC P-MEM-001 (High): Do not reference to deallocated memory |
UFM.DEREF.MIGHT Use of free memory (access) - possible UFM.DEREF.MUST Use of Freed Memory by Pointer UFM.FFM.MIGHT Use of free memory (double free) - possible UFM.FFM.MUST Freeing Freed Memory UFM.RETURN.MIGHT Use of freed memory (return) - possible UFM.RETURN.MUST Use of Freed Memory on Return UFM.USE.MIGHT Use of free memory - possible UFM.USE.MUST Use of Freed Memory |
| HKMC P-MEM-002 (High): Properly deallocate dynamically allocated resources |
CL.FMM Freeing Mismatched Memory - in destructor FMM.MIGHT Freeing Mismatched Memory - possible FMM.MUST Freeing Mismatched Memory |
| HKMC P-MEM-004 (High): Explicitly construct and destruct objects when managing object lifecycle |
CERT.MEM.OBJ_LIFETIME_CTOR Uninitialized Heap Member Function Call CERT.MEM.OBJ_LIFETIME_DTOR Object with manually allocated memory not explicitly destroyed |
| HKMC P-MEM-005 (High): Provide placement new with properly aligned pointers to sufficient storage capacity |
CERT.MEM.PLACEMENTNEW.MISALIGNED Provide placement new with properly aligned storage CERT.MEM.PLACEMENTNEW.TOOSMALL Provide placement new with sufficient storage |
| HKMC P-MEM-006 (High): Do not store an already-owned pointer value in an unrelated smart pointer |
CERT.MEM.SMART_PTR.OWNED Multiple smart pointer owners of pointer CERT.MEM.SMART_PTR.OWNED.THIS The underlying resource might be already owned by a non-related smart pointer |
| HKMC P-MEM-007 (Middle): Memory release missing after lifetime |
MLK.MIGHT Memory Leak - possible MLK.MUST Memory Leak MLK.RET.MIGHT Memory Leak - possible MLK.RET.MUST Memory Leak |
| HKMC P-MSC-001 (Middle): Do not use std::rand() for generating pseudo random number |
CERT.MSC.STD_RAND_CALL Do not use std::rand() for generating pseudorandom numbers |
| HKMC P-MSC-002 (Middle): Proper seeding for random number generator |
AUTOSAR.STDLIB.RANDOM.NBR_GEN_DEFAULT_INIT Random number engines shall not be default-initialized CERT.MSC.SEED_RANDOM Properly seed pseudorandom number generators |
| HKMC P-MSC-003 (Middle): Value returning function require returning values from all exit paths |
FUNCRET.GEN Non-void function does not return value |
| HKMC P-MSC-004 (Middle): Do not return from function declared [[noreturn]] |
CERT.MSC.NORETURN_FUNC_RETURNS Do not return from a function declared [[noreturn]] |
| HKMC P-MSC-005 (Middle): Return of stack variable address |
LOCRET.ARG Function returns address of local variable LOCRET.GLOB Function returns address of local variable LOCRET.RET Function returns address of local variable |
| HKMC P-OOP-001 (Low): Do not invoke virtual functions from constructors or destructors |
CERT.OOP.CTOR.VIRTUAL_FUNC Do not invoke virtual functions from constructors or destructors |
| HKMC P-OOP-003 (Low): Do not delete a polymorphic object without a virtual destructor |
CL.MLK.VIRTUAL Memory Leak - possible in destructor CWARN.DTOR.NONVIRT.DELETE Delete expression for an object of a class with virtual methods and no virtual destructor |
| HKMC P-OOP-004 (Middle): Write constructor member initializers in the fixed order |
CERT.OOP.CTOR.INIT_ORDER Write constructor member initializers in the canonical order |
| HKMC P-OOP-005 (Low): Correctly handle self-copy assignment |
CL.SELF-ASSIGN Use of free memory (double free) - in operator= |
| HKMC P-OOP-006 (High): Do not use pointer-to-member operators to access nonexistent members |
CERT.OOP.PTR_MEMBER.NO_MEMBER Do not use pointer-to-member operators to access nonexistent members |
| HKMC P-OOP-007 (High): Prefer special member functions and overloaded operators over the C standard library |
CERT.OOP.CSTD_FUNC_USE Prefer special member functions and overloaded operators to C Standard Library functions |
| HKMC P-OOP-008 (Low): Do not modify the source object in copy operators |
CERT.OOP.COPY_MUTATES Copy operations must not mutate the source object |
| HKMC P-OOP-009 (Middle): pubic static field do not mark as final |
CXX.STATIC.OBJ.FINAL Initialized public static field not mark as final |
| HKMC P-OOP-010 (Middle): Important data element public declaration |
CXX.MEMBER.IMPORTANT.PRIVATE Important member data shall be private |
| HKMC P-OOP-011 (High): Access critical private variables through public methods |
CXX.MEMBER.CRITICAL.PUBLIC.METHOD Critical private member data shall not be directly writable by a public method |
| HKMC P-STR-001 (High): Guarantee that storage for strings has sufficient space for character data and the null terminator |
NNTS.MIGHT Buffer Overflow - Non-null Terminated String NNTS.MUST Buffer Overflow - Non-null Terminated String SV.FMT_STR.BAD_SCAN_FORMAT Input format specifier error SV.UNBOUND_STRING_INPUT.CIN Usage of cin for unbounded string input SV.UNBOUND_STRING_INPUT.FUNC Usage of unbounded string input |
| HKMC P-STR-003 (High): Do not use invalid references, pointers, and iterators when referencing to basic_string |
CERT.STR_ACCESS.INVALID Use of invalid string iterator or pointer ITER.CONTAINER.MODIFIED Use of invalid iterator |