Document ISO/IEC/JTC 1/SC 22/WG 23 N0704

Meeting Minutes #48
ISO/IEC JTC 1/SC 22/WG23
6-7 April 2017


Meeting Location :

IBM Canada, 8200 Warden Ave, Markham Ontario


Meeting Times:

6-7 April 2017: 0900-1700 Eastern Standard Time (1400-2200 UTC)

Agenda

1 Opening activities

1.1 Opening Comments

1.2 Introduction of Participants/Roll Call

Stephen Michell

Erhard Ploedereder

Larry Wagoner

Tullio Vardenega (Thursday)

Joyce Tokar (Thursday)

Michael Wong (Thursday)

Aaron Ballman (Friday)

Clive Pygott (WebEx)

David Keaton (Friday)

Tom Scogland (Friday)

Paul Preney

Hubert Tong

1.3 Procedures for this Meeting

1.4 Approval of previous Minutes (meeting 46, document N674)

approved

1.5 Review of actions items and resolutions, Action Item and Decision Logs

1.6 Approval of Agenda [N 0697]

1.7 Future Meeting Schedule


2018






Pre-mtg 56

01/11/18



#55

12-14/09/18

Toronto, Ontario, Canada


#54

15-16/06/18

With WG 9 and Ada Europe


Pre-mtg-54


Teleconference


#53

TBD April 2018

Brno, Chez Republic


Pre-mtg 53

TBD March 2018

Teleconference

#52

22-23 January 2018

Phoenix, AZ, CSA Group office


2017

pre-mtg-52

20/11/17

Teleconference (UTC 2000, 2 hr)


#51

6-10 Nov 2017 (possible)

Sandia, NM if WG 21 SG materializes


post-mtg-50

16/10/17

Teleconference (UTC 2000, 2 hr)


#50

17-18 August 2017

BSI London (with SC 22 Plenary)


#49

19-20 June 2017

Vienna, Austria with Ada Europe(2 day)


post-mtg-48

15/05/17

Teleconference (UTC 2000, 2 hr)














2. Liaison Activities

2.1 SC 22

2.2 PL 22 (Open)

2.3 PL22.3/WG5 (Fortran)

2.4 WG4 (COBOL)

2.5 WG9 (Ada)

2.6 PL22.11/WG14 (C)

2.7 PL22.16/WG21 (C++)

2.8 Ecma International, TC49/TG2 (C#)

2.9 Ecma International, TC39 (ECMAScript)

2.10 MISRA (C)

2.11 MISRA (C++)

2.12 SPARK

2.13 SC7/WG19 (UML)

2.14 SC27/WG3, WG4 Security

2.15 Other Liaison Activities or National body reports

3. Document Review

Action items 48-01 through 05 are in N0700 Minutes of pre-meeting 48 WebEx

3.1 TR 24772-1 Vulnerabilities, language independent

Latest version of TR24772-1

AI 48-06 – Erhard, Clive - We discuss issues about some C/C++ issues such as const and static. If there is a vulnerability here that is not covered, propose one with a partial writeup. Clive and Erhard.


AI 48-07 – Steve – Clause 6.5, enumeration – write up scoping issue and type promotion/implicit conversions of enumerated types.

AI 48-08 – Steve - Change 6.63 Protocol Lock Errors to Lock protocol errors

3.2 TR 24772-2 Ada language specific part

Latest version of TR 24772-2 Ada

3.3 TR 24772-3 C language specific part

Latest version of TR 24772-3 C

We note that the concept of explicit casts is missing. A proposal is needed. We may need a ‘const’ vulnerability.

AI 48-09 – Clive: Propose text for clause 4 Language concepts in TR 24772-3 C specific language vulnerabilities, to be reviewed by WG 14 afterward.

3.4 TR 24772-4 Python language specific part

Document N0592.

3.5 TR 24772-8 Fortran

Document [N0560] needs review.

3.6 TR 24772-X C++

Discussions of document N0691 or later version.

Discussion of reaching out to WG 21. There is a WG 21 SG on undefined behaviour. Idea to create a SG for vulnerabilities (safety and security), connected with the core guidelines. Present to WG 21 in Toronto, July and how WG 21 can participate. Maybe a study group to look at how WG 21 can contribute to TR 24772-10, and to recommend language approaches and features to reduce the vulnerability posture.


AI 48-10 – Stephen Michell - Paper needed by June 19. Form a group to prepare – Stephen, Michael, Paul, Hubert, Erhard (comment), Tullio (comment)


Standards to be aware of

ISO 26262

IEC 61508


People to include, if possible,

Aaron Ballman (aaron@aaronballman.com), David Svoboda, Patrice Roy, Gabriel Dos Reis, David Sankel, Michael Wong

3.7 Bibliography for each TR24772 Part

3.8 Dirty Dozen Rules for C, generic, and other languages

Review how the rules are incorporated into Part 1 and Part 3. Consider the generic rules for other Parts.

4 Strategy (Face to face meetings only)

5 Publicity (Face to face meetings only)

6 Other Business

6.1 Review of Assignment of responsibilities


7. Resolutions and Action Items

Action items 48-01 through 05 are in N0700 Minutes of pre-meeting 48 WebEx

AI 48-06 – Clive Pygott and Erhard Ploedereder – propose a writeup for vulnerabilities associated with static casts, const casts and reinterpretation casts


AI 48-07 – Stephen Michell – Clause 6.5, enumeration – write up scoping issue and type promotion/implicit conversions of enumerated types.


AI 48-08 – Stephen Michell - Change 6.63 Protocol Lock Errors to Lock protocol errors


AI 48-09 – Clive Pygott - Propose text for clause 4 Language concepts in TR 24772-3 C specific language vulnerabilities, to be reviewed by WG 14 afterward.


AI 48-10 – Stephen Michell - Paper for addressing C++ vulnerabilities needed by June 19. Form a group to prepare – Stephen, Michael, Paul, Hubert, Erhard (comment), Tullio (comment)

8. Adjournment