Home » Blog » Categories »

CWE Top 25 2021. What is it, what is it for and how is it useful for static analysis?

By Andrey Karpov | Sep 29, 2021 01:23 PM | Tags: static analysis sast pvs-studio devtool cwetop25 cwe cvss common weakness enumeration

For the first time PVS-Studio provided support for the CWE classification in the 6.21 release. It took place on January 15, 2018. Years have passed since then and we would like to tell you about the improvements related to the support of this classification in the latest analyzer version.

CWE Top 25 2021. What is it, what is it for and how is it useful for static analysis?

by Mikhail Gelvih

From the article:

We have been using the CWE classification for PVS-Studio diagnostics for more than three years. Their number increases every year. In 2018, we covered only 94 points on the CWE list. Now it's almost 130. However, this article isn't about the total number of diagnostics. Let's talk about those that are included in the list of the most dangerous diagnostics in 2021. If you want to read the full list, you can get it in the "CWE compliance" section of our documentation.

2021-09 Mailing Available

By Administrator | Sep 28, 2021 02:25 PM | Tags: None

The 2021-09 mailing of new standards papers is now available.

 

WG21 Number Title Author Document Date Mailing Date Previous Version Subgroup
P0288R7 move_only_function (was any_invocable) Matt Calabrese, Ryan McDougall 2021-08-27 2021-09 P0288R6 LWG Library
P0447R16 Introduction of std::hive to the standard library Matt Bentley 2021-09-08 2021-09 P0447R15 SG14 Low Latency,LEWG Library Evolution,All of WG21
P0627R5 Function to mark unreachable code Jens Maurer 2021-09-19 2021-09 P0627R3 LWG Library
P0849R8 auto(x): decay-copy in the language Zhihao Yuan 2021-08-26 2021-09 P0849R7 CWG Core,LWG Library
P1018R13 C++ Language Evolution status pandemic edition 2021/06–2021/08 JF Bastien 2021-09-06 2021-09 P1018R12 EWG Evolution,All of WG21
P1072R10 basic_string::resize_and_overwrite Chris Kennelly 2021-09-14 2021-09 P1072R9 LWG Library
P1885R7 Naming Text Encodings to Demystify Them Corentin Jabot 2021-09-14 2021-09 P1885R6 LEWG Library Evolution
P2012R1 Fix the range-based for loop, Rev1 Nicolai Josuttis 2021-09-16 2021-09 P2012R0 EWG Evolution,CWG Core
P2036R3 Changing scope for lambda trailing-return-type Barry Revzin 2021-09-14 2021-09 P2036R2 CWG Core
P2066R9 Suggested draft TS for C++ Extensions for Minimal Transactional Memory Jens Maurer 2021-09-15 2021-09 P2066R8 CWG Core,LWG Library
P2093R9 Formatted output Victor Zverovich 2021-09-09 2021-09 P2093R8 LEWG Library Evolution
P2128R6 Multidimensional subscript operator Corentin Jabot 2021-09-14 2021-09 P2128R5 CWG Core
P2214R1 A Plan for C++23 Ranges Barry Revzin 2021-09-14 2021-09 P2214R0 LEWG Library Evolution
P2266R2 Simpler implicit move Arthur O'Dwyer 2021-08-31 2021-09 P2266R1 EWG Evolution,CWG Core
P2276R1 Fix cbegin Nicolai Josuttis 2021-09-10 2021-09 P2276R0 LEWG Library Evolution,LWG Library
P2278R1 cbegin should always return a constant iterator Barry Revzin 2021-09-15 2021-09 P2278R0 LEWG Library Evolution
P2314R3 Character sets and encodings Jens Maurer 2021-09-15 2021-09 P2314R2 CWG Core,LWG Library
P2316R2 Consistent character literal encoding Corentin Jabot 2021-09-14 2021-09 P2316R1 SG22 Compatability,CWG Core
P2322R4 ranges::fold Barry Revzin 2021-09-12 2021-09 P2322R3 LEWG Library Evolution
P2348R1 Whitespaces Wording Revamp Corentin Jabot 2021-09-15 2021-09 P2348R0 SG16 Unicode
P2362R3 Remove non-encodable wide character literals and multicharacter wide character literals Peter Brett 2021-08-27 2021-09 P2362R2 SG22 Compatability,CWG Core
P2363R1 Extending associative containers with the remaining heterogeneous overloads Konstantin Boyarinov 2021-09-15 2021-09 P2363R0 LEWG Library Evolution
P2372R3 Fixing locale handling in chrono formatters Victor Zverovich 2021-09-12 2021-09 P2372R2 LWG Library
P2388R1 Abort-only contract support Andrzej Krzemieński 2021-09-14 2021-09 P2388R0 SG21 Contracts
P2388R2 Minimum Contract Support: either Ignore or Check_and_abort Andrzej Krzemieński 2021-09-19 2021-09 P2388R1 SG21 Contracts
P2390R1 Add annotations for unreachable control flow Jens Gustedt 2021-09-17 2021-09 P2390R0 SG22 Compatability
P2408R1 Ranges views as inputs to non-Ranges algorithms David Olsen 2021-08-31 2021-09 P2408R0 LEWG Library Evolution
P2418R1 Add support for std::generator-like types to std::format Victor Zverovich 2021-09-12 2021-09 P2418R0 LWG Library
P2419R1 Clarify handling of encodings in localized formatting of chrono types Victor Zverovich 2021-09-19 2021-09 P2419R0 LEWG Library Evolution
P2430R0 Slides: Partial success scenarios with P2300 Christopher Kohlhoff 2021-08-23 2021-09   LEWG Library Evolution
P2431R0 Presentation: Plans for P2300 Revision 2 Michael Garland 2021-08-25 2021-09   SG1 Concurrency and Parallelism,LEWG Library Evolution
P2432R0 Fixing istream_view Nicolai Josuttis 2021-08-27 2021-09   SG9 Ranges,LEWG Library Evolution,LWG Library
P2435R0 2021 Summer Library Evolution Poll Outcomes Bryce Adelstein Lelbach 2021-09-09 2021-09   LEWG Library Evolution
P2436R0 2021 September Library Evolution Polls Bryce Adelstein Lelbach 2021-09-14 2021-09   LEWG Library Evolution
P2437R0 Support for #warning Aaron Ballman 2021-09-09 2021-09   EWG Evolution
P2438R0 std::string::substr() && Federico Kircheis 2021-09-14 2021-09   LEWGI SG18: LEWG Incubator,LEWG Library Evolution
P2439R0 Slides for P2415R1, what is a view? Tim Song 2021-09-10 2021-09   LEWG Library Evolution
P2440R0 ranges::iota, ranges::shift_left, and ranges::shift_right Tim Song 2021-09-12 2021-09   LEWG Library Evolution
P2441R0 views::join_with Barry Revzin 2021-09-14 2021-09   LEWG Library Evolution
P2442R0 Windowing range adaptors: views::chunk and views::slide Tim Song 2021-09-14 2021-09   LEWG Library Evolution
P2443R0 views::chunk_by Tim Song 2021-09-14 2021-09   LEWG Library Evolution
P2444R0 The Asio asynchronous model Christopher Kohlhoff 2021-09-15 2021-09   LEWG Library Evolution
P2446R0 views::move Barry Revzin 2021-09-17 2021-09   LEWG Library Evolution

CppCon 2020 Constructing Generic Algorithms: Principles and Practice--Ben Deane

By Adrien Hamelin | Sep 27, 2021 12:48 PM | Tags: community

Registration is now open for CppCon 2021, which starts on October 24 and will be held both in person and online. To whet your appetite for this year’s conference, we’re posting videos of some of the top-rated talks from our most recent in-person conference in 2019 and our online conference in 2020. Here’s another CppCon talk video we hope you will enjoy – and why not register today for CppCon 2021 to attend in person, online, or both!

Constructing Generic Algorithms: Principles and Practice

by Ben Deane

Summary of the talk:

"You have all these algorithms at your disposal. *Learn them.*"
-- Sean Parent, GoingNative 2013.

Great advice, and the algorithms can do a lot. But they can't do everything, and the fixed set in the standard was never meant to be the last word in every problem. Sometimes we do need to write our own solutions. What are the best practices for that?

This talk examines how to build our own algorithms. We'll start with a raw loop that solves a nontrivial problem, and turn it into a generic algorithm capable of supporting a wide variety of use cases without loss of expressivity or efficiency.

Along the way we'll consider algorithmic patterns, how to structure the
interface, how the types interact, iterator category concerns, testing, and
more. We'll look at how ranges and concepts help us to refine and focus things.

We'll also see where the existing algorithms fall short, and take a look at some non-obvious use cases, including some minor modifications or wrappings that give us extra flexibility.

C++20 Coroutines — Complete* Guide--Šimon Tóth

By Adrien Hamelin | Sep 27, 2021 12:38 PM | Tags: c++20

Learn to use them.

C++20 Coroutines — Complete* Guide

by Šimon Tóth

From the article:

C++20 brought us initial support for coroutines. In this article, we will go over several examples of coroutines that build upon each other. Word of warning, though, the support in C++20 is mainly targeted at library implementors. C++23 should be bringing additional support that should cover at least the most common use cases...

C++20 Coroutine Iterators--Martin Bond

By Adrien Hamelin | Sep 27, 2021 12:36 PM | Tags: c++20

The series continue.

C++20 Coroutine Iterators

by Martin Bond

From the article:

In my first blog post about C++20 Coroutines I introduced the concepts behind a synchronous or generator style coroutine and developed a template class to support coroutines for any data type.

In this post I’ll add an iterator to the template to support the range-for loop and iterative algorithms. You may want to review that post before reading this one but the following code should act as a reminder about how to write and use a coroutine to read two floating point values into a data structure for subsequent analysis...

CppCon 2019 Behind Enemy Lines - Reverse Engineering C++ in Modern Ages--Gal Zaban

By Adrien Hamelin | Sep 24, 2021 12:47 PM | Tags: community

Registration is now open for CppCon 2021, which starts on October 24 and will be held both in person and online. To whet your appetite for this year’s conference, we’re posting videos of some of the top-rated talks from our most recent in-person conference in 2019 and our online conference in 2020. Here’s another CppCon talk video we hope you will enjoy – and why not register today for CppCon 2021 to attend in person, online, or both!

Behind Enemy Lines - Reverse Engineering C++ in Modern Ages

by Gal Zaban

Summary of the talk:

What do C++ programs really look like? When developers think about hierarchy and virtual calls they see it as design patterns and code but reverse engineers look at it from a different angle, they think about Assembly puzzles.

C++ is known as a tangled language, templates, lambdas and pointers. All of these features create a jungle of objects intended to make life easier for the programmer. But once the program is compiled, the target program is no longer what it once seemed.

Reversing C++ programs is tedious, demanding, and requires rebuilding inheritance, identifying templates and tainting program flow in order to combat the ties of function overloading and class utilization.

C++ Binaries are a world of mysteries. In my presentation I am going to show how C++ binaries looks like after compilation and how reverse engineers see C++ binaries and understand their logic...