ISO/IEC JTC 1/SC 22/WG 23/N 0441
Draft Minutes: Meeting #25
ISO/IEC JTC 1/SC 22/WG 23: Programming Language Vulnerabilities
13-15 March 2013

Meeting Times:

13 March 2013: 9:00 am to 4:00 pm (US-east coast)
14 March 2013: 9:00 am to 4:00 pm (US-east coast)
15 March 2013: 9:00 am to 12:00 pm (US-east coast)

Meeting Information:

See document: N 0413

Meeting Location:

ANSI
25 West 43^rd Street, 4^th Floor (between 5^th & 6^th)
New York, NY 10036
212-642-4900

Local Contacts:

Marisa Peacock

Senior Program Manager
Tel: +1 212 642-4904
Email: Marisa Peacock

Stephanie Carroll

Meetings and Events Manager
Tel: +1 212 642-4890
Fax: +1 212 398-0023
Email: Stephanie Carroll

Teleconference information:

Topic: WG 23 Meeting #25
Date: Every 1 day, from Wednesday, March 13, 2013 to Friday, March 15, 2013
Time: 9:00 am, Eastern Daylight Time (New York, GMT-04:00)

Meeting Number: 950 756 350
Meeting Password: wg23

To start or join the online meeting, go to iso_meetings
To view in other time zones or languages, please click the link: iso_meetings

To receive a call back, provide your phone number when you join the meeting, or call the number below and enter the access code.

Switzerland toll free: 0800-894627
USA/Canada toll free: 1-855-299-5224

Having trouble dialing in? Try these backup numbers:

Call-in toll-free number (UK): 0800-051-3810
Call-in toll number (UK): +44-20-310-64804
Global call-in numbers: iso_meetings call-in numbers
Toll-free dialing restrictions: toll-free restrictions

Access code: 950 756 350

For assistance:

1. Go to iso_meetings support
2. On the left navigation bar, click "Support".
To add this meeting to your calendar program (for example Microsoft Outlook), click this link: iso_meetings to calendar

Agenda

1. Opening activities

1.1 Opening Comments

1.2 Introduction of Participants/Roll Call

Clive Pygott		UK
Tatsuaki Takebe		Japan
Kazuyoshi Korosue		Japan
Steve Michell		Canada
David Keaton		USA
Tom Plum		USA
Larry Wagoner		USA
John Benito		Convener

1.3 Procedures for this Meeting

Consideration for the participants using the WebEx feature should be given.

1.4 Approval of previous Minutes [N 0432]

Minutes approved without changes

1.5 Review of actions items and resolutions, Action Item and Decision Logs

• #22-03 moved to closed

1.6 Approval of Agenda [N 0435]

Approved with the addition of N0438, N0439, and N0442
N0443 was added during the meeting

1.7 Future Meeting Schedule

• The meeting schedule was discussed, several experts would like to have the June 2014 meeting in Kona HI. There is an open action item to try to co-locate with WG 21 (C++) in June. If that can not be arranged, meeting #30 was tentatively set for Kona HI. If meeting #30 is in Kona HI, meeting #29 will move to Ottawa Canada.
• Meeting #31 is still open, but the desire is to co-locate with the SC22 plenary.
• Meeting #32 will be a teleconference.
• Two teleconferences a year schedule was discussed, no consensus was reached, but the committee will revisit this at a later date

2014
WG23 #29	TBD	Kona, Hawaii, USA	—
2013
WG23 #28	December	Web conference	—
WG23 #27	September 19-21	Tokyo, Japan	WG23 meeting co-located with SC22 plenary meeting.
WG23 #26	June 08-10	Berlin, DE	Co-located with WG 9, Ada Europe

2. Reports on Liaison Activities

2.1 SC 22

No report

2.2 PL22.3/WG5 (Fortran)

• WG 5 has furnished a Langauge Specific Annex to WG 23 for inclusion in TR 24772, see N0442

2.3 PL22.4/WG4 (COBOL)

No report

2.4 WG9 (Ada)

No report

2.5 PL22.11/WG14 (C)

• WG 14 has a new work item (18661) for floating-point
• PDTS 17961 is currently in ballot at SC 22
• WG 14 is meeting in Delft NL in April

2.6 PL22.16/WG21 (C++)

• WG 21 has started several study groups, based on the model used by WG 14
• New work item is started for an amendment

2.7 Ecma International, TC49/TG2 (C#)

No report

2.8 Ecma International, TC39 (ECMAScript)

No report

2.9 MISRA (C)

• The new MISRA C based on 9899:1999 has been released and should be available

2.10 MISRA (C++)

No report

2.11 SPARK

No report

2.12 SC7/WG19 (UML)

No report

2.13 Other Liaison Activities or National body reports

3. Document Review

NOTE: The CD ballot for the 17960 will still be active, we will not discuss 17960.

1. Proposed New Vulnerabilities – [N 0433]
• Several small editorial changes were suggested
• The consensus was to include these vulnerabilities with the appropriate editorial changes to the working draft of TR 24772
2. Discuss approach for next revision of TR 24772
• Another 3 year schedule
• Langauge annexes for C#, Java, Java Script, Objective C, and C++ are desirable
• Finish the work on Concurrency
• Use the work started in [N 0439]
• Use the work (with editorial changes) in [N 0442]
• Use the work (with changes agreed in meeting #25) in [N 0433]
• Use the work in [N 0444]
3. Proposed new vulnerability on tainted sources – [N 0438]
• Several small changes were suggested, see [N 0444] for changes.
• There was consensus to add to the working draft of TR 24772
4. Fundamental Vulnerabilities – [N 0439]
• It was pointed out that the reference work is not current
• Hardware (data types) is more of a portability issue and probably should not be considered a fundamental vulnerability
• Many felt that the work on TR 24772 was based on what was believed to be fundamental vulnerabilities, while the approach for defining the fundamental vulnerabilities in this document is different
• General consensus is that this work should be continued and used for verify the current vulnerabilities, identifying new vulnerabilities, and improving the mitigation subclauses
5. Fortran Annex – [N 0442]
• It was noted the sub-clause headers are not consistent with the current base document
• It was noted that where the mitigation matches the base document, this document should just reference the base document
• It was noted that the lead paragraphes to the subsections are inconsistent with the base document
• The general consensus is we should add this to the working draft with the appropriate edits to make the annex consistent with the base document and the other language annexes
6. Guidelines for Publicity – [N 0443]
• Several small edits were suggested, see [N 0445]

4. Other Business

4.1 Promotion of WG23 Products, Steve Michell, per Action Item #21-6

See [N 0445]

5. Resolutions

None

6. Thank the Host

• Thanks to our Host ANSI and especially Marisa Peacock for all of the work to make this happen.

7. Adjournment