CERT C for Security

#include 
#include 

/* CERT INT30-C: Ensure unsigned integer operations do not wrap */
/* Unsigned wrapping is defined but often a logic error */
uint32_t safe_add_u32(uint32_t a, uint32_t b, uint32_t *result)
{
    if (b > (UINT32_MAX - a)) {
        return 0u;  /* overflow: return error */
    }
    *result = a + b;
    return 1u;  /* success */
}

/* CERT INT32-C: Ensure signed integer operations do not overflow */
/* Signed overflow is undefined behaviour in C */
int32_t safe_add_i32(int32_t a, int32_t b, int32_t *result)
{
    if (((b > 0) && (a > (INT32_MAX - b))) ||
        ((b < 0) && (a < (INT32_MIN - b)))) {
        return 0;  /* overflow detected */
    }
    *result = a + b;
    return 1;
}

/* CERT INT31-C: Ensure integer conversions do not lose data/sign */
/* Unsafe: */
int32_t big = 100000;
uint8_t small_unsafe = (uint8_t)big;  /* truncates to 160 — wrong! */

/* Safe: check before converting */
uint8_t to_u8_safe(int32_t val) {
    if ((val < 0) || (val > 255)) {
        /* handle range error */
        return 0u;
    }
    return (uint8_t)val;
}

#include 
#include 

/* CERT STR31-C: Guarantee that storage for strings has sufficient space
   Vulnerable: strcpy without bounds check */
void unsafe_copy(char *dst, const char *src) {
    strcpy(dst, src);  /* VULNERABLE: src may be longer than dst */
}

/* Safe: use strncpy with explicit length limit */
void safe_copy(char *dst, size_t dst_size, const char *src) {
    if ((dst == NULL) || (src == NULL) || (dst_size == 0u)) { return; }
    strncpy(dst, src, dst_size - 1u);  /* leave room for null terminator */
    dst[dst_size - 1u] = '';         /* explicitly null-terminate */
}

/* CERT ARR30-C: Prevent array index out of bounds */
#define DID_TABLE_SIZE  32u
typedef void (*DidHandler_t)(void);
static DidHandler_t g_did_handlers[DID_TABLE_SIZE];

void call_did_handler(uint8_t did_index) {
    /* Unsafe: no bounds check */
    /* g_did_handlers[did_index](); */  /* if did_index >= 32 → out of bounds */

    /* Safe: check before access */
    if ((did_index < DID_TABLE_SIZE) && (g_did_handlers[did_index] != NULL)) {
        g_did_handlers[did_index]();
    }
}

/* CERT MEM35-C: Allocate sufficient memory for object */
/* In embedded: prefer static allocation; no malloc/free in ASIL code */