ISO/IEC TS 17961:2013 情報技術—プログラミング言語、その環境、およびシステムソフトウェアインターフェイス—Cの安全なコーディングルール | ページ 6

4.1

analyzer

mechanism that diagnoses coding flaws in software programs

Note 1 to entry: Analyzers may include static analysis tools, tools within a compiler suite, or tools in other contexts.

4.2

data flow analysis

tracking of value constraints along nonexcluded paths through the code

Note 1 to entry: Tracking can be performed intraprocedurally, with various assumptions made about what happens at function call boundaries, or interprocedurally ここで, values are tracked flowing into function calls (directly or indirectly) as arguments and flowing back out either as return values or indirectly through arguments.

Note 2 to entry: Data flow analysis may or may not track values flowing into or out of the heap or take into account global variables. When this specification refers to values flowing, the key point is contrast with variables or expressions, because a given variable or expression may hold different values along different paths, and a given value may be held by multiple variables or expressions along a path.

4.3

exploit

technique that takes advantage of a security vulnerability to violate an explicit or implicit security policy

4.4

in-band error indicator

library function return value on error that can never be returned by a successful call to that library function

4.5

mutilated value

Note 1 to entry: A mutilated value can be just as dangerous as a tainted value because it can differ either in sign or magnitude from what the programmer expects.

4.6

nonpersistent signal handler

signal handler running on an implementation that requires the program to again register the signal handler after occurrences of the signal to catch subsequent occurrences of that signal

4.7

out-of-band error indicator

library function return value used to indicate nothing but the error status

4.8

out-of-domain value

one of a set of values that is not in the domain of a particular operator or function

4.9

restricted sink

operands and arguments whose domain is a subset of the domain described by their types

Note 1 to entry: Undefined or unexpected behavior may occur if a tainted value is supplied as a value to a restricted sink.

Note 2 to entry: A diagnostic is required if a tainted value is supplied to a restricted sink.

Note 3 to entry: Different restricted sinks may impose different validity constraints for the same value; a given value can be tainted with respect to one restricted sink but sanitized (and consequently no longer tainted) with respect to a different restricted sink.

Note 4 to entry: Specific restricted sinks and requirements for sanitizing tainted values are described in specific rules dealing with taint analysis (see 5.8, 5.14, 5.24, 5.30, 5.39, and 5.46).

4.10

sanitize

assure by testing or replacement that a tainted or other value conforms to the constraints imposed by one or more restricted sinks into which it may flow

Note 1 to entry: If the value does not conform, either the path is diverted to avoid using the value or a different, known-conforming value is substituted.

4.11

security flaw

defect that poses a potential security risk

4.12

security policy

set of rules and practices that specify or regulate how a system or organization provides security services to protect sensitive and critical system resources

4.13

static analysis

any process for assessing code without executing it

Note 1 to entry: See ^[1], p. 3.

4.14

tainted source

external source of untrusted data

4.15

tainted value

value derived from a tainted source that has not been sanitized

4.16

target implementation

implementation of the C programming language whose environmental limits and implementation-defined behavior are assumed by the analyzer during the analysis of a program

4.17

UB

undefined behavior

4.18

unexpected behavior

well-defined behavior that may be unexpected or unanticipated by the programmer; incorrect programming assumptions

4.19

unsigned integer wrapping

computation involving unsigned operands whose result is reduced modulo the number that is one greater than the largest value that can be represented by the resulting type

4.20

untrusted data

data originating from outside of a trust boundary

Note 1 to entry: See ^[2].

4.21

valid pointer

pointer that refers to an element within an array or one past the last element of an array

Note 1 to entry: For the purposes of this definition, a pointer to an object that is not an element of an array behaves the same as a pointer to the first element of an array of length one with the type of the object as its element type. (See ISO/IEC 9899:2011, 6.5.8, paragraph 4.)

Note 2 to entry: For the purposes of this definition, an object can be considered to be an array of a certain number of bytes; that number is the size of the object, as produced by the sizeof operator. (See ISO/IEC 9899:2011, 6.3.2.3, paragraph 7.)

4.22

vulnerability

set of conditions that allows an attacker to violate an explicit or implicit security policy