Overview
ISO/IEC TR 24772-2:2020 - Programming languages: Guidance to avoiding vulnerabilities in programming languages - Part 2: Ada provides targeted guidance on how language-level vulnerabilities described in Part 1 manifest in the Ada programming language. The technical report identifies common software vulnerabilities relevant to security, safety, mission-critical and business-critical systems and explains Ada-specific applicability and avoidance techniques. It is intended for any software developed, reviewed or maintained where assured behaviour is required.
Key Topics
The report maps general vulnerability classes to Ada and offers practical guidance. Major technical topics include:
- Type system issues and user-defined types
- Bit representation and representation attributes
- Floating-point arithmetic pitfalls and conversions
- Enumerator and conversion errors
- String termination and buffer boundary violation (buffer overflow)
- Unchecked array indexing and copying
- Pointer issues: pointer type conversions, pointer arithmetic, null pointer dereference, dangling references to heap
- Arithmetic wrap-around and misuse of bit shifts for arithmetic
- Pragma and implementation-defined features (Atomic, Pack, Volatile, Import/Export, Unchecked_Union, etc.)
- Storage pool and separate compilation concerns
- Unsafe programming constructs and compiler directives
- Coding quality topics: naming, dead stores, unused variables, identifier reuse, initialization, operator precedence, side-effects, likely incorrect expressions, dead code, switch statements, loop control and off-by-one errors
The table of contents shows the document organizes each topic with sections on applicability to Ada and guidance to language users, making it practical for developers and reviewers.
Applications and Who Would Use It
ISO/IEC TR 24772-2:2020 is useful for:
- Ada developers implementing safety- or security-critical systems
- Software architects and system engineers choosing language features and compiler options
- Code reviewers and security auditors performing vulnerability assessments and secure code reviews
- Certification teams working on assurance cases for avionics, rail, medical, or industrial control software
- Static-analysis and tool vendors adapting checks to Ada-specific vulnerabilities
- Trainers and educators teaching secure Ada programming practices
Typical applications include secure coding standards, static-analysis rule sets, code hardening, and guidance for certification and compliance in safety-critical projects.
Related Standards
- ISO/IEC TR 24772-1 - General guidance on vulnerabilities in programming languages (the parent document that defines vulnerability classes referenced in Part 2)
Keywords: ISO/IEC TR 24772-2:2020, Ada, programming languages, vulnerabilities, secure coding, safety-critical, buffer overflow, pointer safety, static analysis.
