Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Ansible
Apex
AzureResourceManager
C
C#
C++
CloudFormation
COBOL
CSS
Dart
Docker
Flex
Go
HTML
Java
JavaScript
JCL
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

C static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C code

Filtered: 58 rules found

cwe

Impact

Clean code attribute

"memset" should not be used to delete sensitive data
Vulnerability
POSIX functions should not be called with arguments that trigger buffer overflows
Vulnerability
XML parsers should not be vulnerable to XXE attacks
Vulnerability
Function-like macros should not be invoked without all of their arguments
Bug
"pthread_mutex_t" should not be locked when already locked, or unlocked when already unlocked
Bug
Dynamically allocated memory should be released
Bug
Freed memory should not be used
Bug
Memory locations should not be released more than once
Bug
Memory access should be explicitly bounded to prevent buffer overflows
Bug
Resources should be closed
Bug
Hard-coded credentials are security-sensitive
Security Hotspot
Switch cases should end with an unconditional "break" statement
Code Smell
Accessing files should not introduce TOCTOU vulnerabilities
Vulnerability
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Server hostnames should be verified during SSL/TLS connections
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
Cryptographic keys should be robust
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
Insecure functions should not be used
Vulnerability
"scanf()" and "fscanf()" format strings should specify a field width for the "%s" string placeholder
Vulnerability
Function exit paths should have appropriate return values
Bug
Zero should not be a possible denominator
Bug
"sprintf" should not be used
Security Hotspot
Changing working directories without verifying the success is security-sensitive
Security Hotspot
Using "tmpnam", "tmpnam_s" or "tmpnam_r" is security-sensitive
Security Hotspot
Changing directories improperly when using "chroot" is security-sensitive
Security Hotspot
Using publicly writable directories is security-sensitive
Security Hotspot
Using clear-text protocols is security-sensitive
Security Hotspot
Expanding archive files without controlling resource consumption is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Using pseudorandom number generators (PRNGs) is security-sensitive
Security Hotspot
Blocking functions should not be called inside critical sections
Code Smell
Account validity should be verified when authenticating users with PAM
Vulnerability
Non-empty statements should change control flow or have at least one side-effect
Bug
Variables should be initialized before use
Bug
"sizeof" should not be called on pointers
Bug
Conditionally executed code should be reachable
Bug
Null pointers should not be dereferenced
Bug
All code should be reachable
Bug
Setting capabilities is security-sensitive
Security Hotspot
Using "strncpy" or "wcsncpy" is security-sensitive
Security Hotspot
Using "strncat" or "wcsncat" is security-sensitive
Security Hotspot
Using "strcat" or "wcscat" is security-sensitive
Security Hotspot
Using "strlen" or "wcslen" is security-sensitive
Security Hotspot
Using "strcpy" or "wcscpy" is security-sensitive
Security Hotspot
Setting loose POSIX file permissions is security-sensitive
Security Hotspot
Multiline blocks should be enclosed in curly braces
Code Smell
Unused assignments should be removed
Code Smell
Track uses of "FIXME" tags
Code Smell
Assignments should not be made from within conditions
Code Smell
"nonnull" parameters and return values of "returns_nonnull" functions should not be null
Bug
Code annotated as deprecated should not be used
Code Smell
Track uses of "TODO" tags
Code Smell
"switch" statements should have "default" clauses
Code Smell
The number of arguments passed to a function should match the number of parameters
Bug
Bitwise operators should not be applied to signed operands
Bug
Limited dependence should be placed on operator precedence
Code Smell

The number of arguments passed to a function should match the number of parameters

intentionality - logical

reliability

Bug

MajorSonarSource default severity
click to learn more

cwe
based-on-misra
cert

Why is this an issue?

More Info

This problem is completely avoided by the use of function prototypes. See MISRA C:2004 Rule 8.1. This rule is retained since compilers may not flag this constraint error.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Developer
Edition

© 2008-2024 SonarSource SA. All rights reserved. SONAR, SONARSOURCE, SONARQUBE, and CLEAN AS YOU CODE are trademarks of SonarSource SA.

Sonar helps developers write Clean Code.
Privacy Policy | Cookie Policy

In-IDE

SaaS

Self-Hosted