"At Cisco, we have adopted the CERT C Coding Standard as the internal secure coding standard for all C developers. It is a core component of our secure development lifecycle. The coding standard described in this book breaks down complex software security topics into easy-to-follow rules with excellent real-world examples. It is an essential reference for any developer who wishes to write secure and resilient software in C and C++." -Edward D. Paradise, vice president, engineering, threat response, intelligence, and development, Cisco Systems

Secure programming in C can be more difficult than even many experienced programmers realize. To help programmers write more secure code, The CERT® C Coding Standard, Second Edition, fully documents the second official release of the CERT standard for secure coding in C. The rules laid forth in this new edition will help ensure that programmers' code fully complies with the new C11 standard; it also addresses earlier versions, including C99.

The new standard itemizes those coding errors that are the root causes of current software vulnerabilities in C, prioritizing them by severity, likelihood of exploitation, and remediation costs. Each of the text's 98 guidelines includes examples of insecure code as well as secure, C11-conforming, alternative implementations. If uniformly applied, these guidelines will eliminate critical coding errors that lead to buffer overflows, format-string vulnerabilities, integer overflow, and other common vulnerabilities.

This book reflects numerous experts' contributions to the open development and review of the rules and recommendations that comprise this standard.

Coverage includes

• Preprocessor
• Declarations and Initialization
• Expressions
• Integers
• Floating Point
• Arrays
• Characters and Strings
• Memory Management
• Input/Output
• Environment
• Signals
• Error Handling
• Concurrency
• Miscellaneous Issues

Robert C. Seacord is a computer security specialist and writer. He is the author of books on computer security, legacy system modernization, and component-based software engineering.

Robert C. Seacord manages the Secure Coding Initiative in the CERT Division of Carnegie Mellon's Software Engineering Institute (SEI) in Pittsburgh, PA. CERT, among other security related activities, regularly analyzes software vulnerability reports and assesses the risk to the Internet and other critical infrastructure. Robert is an adjunct professor in the Carnegie Mellon University School of Computer Science and in the Information Networking Institute. He represents CMU at PL22.11 (ANSI "C") and is a technical expert for the JTC1/SC22/WG14 international standardization working group for the C programming language.

Robert started programming professionally for IBM in 1982, working in communications and operating system software, processor development, and software engineering. Robert also has worked at the X Consortium, where he developed and maintained code for the Common Desktop Environment and the X Window System.

Robert has a B.A. in computer science from Rensselaer Polytechnic Institute.

Preface xiii Acknowledgments xxxvii Contributors xxxix About the Author xliii

Chapter 1: Preprocessor (PRE) 1 PRE30-C. Do not create a universal character name through concatenation 2 PRE31-C. Avoid side effects in arguments to unsafe macros 3 PRE32-C. Do not use preprocessor directives in invocations of function-like macros 8

Chapter 2: Declarations and Initialization (DCL) 11 DCL30-C. Declare objects with appropriate storage durations 12 DCL31-C. Declare identifiers before using them 16 DCL36-C. Do not declare an identifier with conflicting linkage classifications 20 DCL37-C. Do not declare or define a reserved identifier 23 DCL38-C. Use the correct syntax when declaring a flexible array member 29 DCL39-C. Avoid information leakage in structure padding 32 DCL40-C. Do not create incompatible declarations of the same function or object 37 DCL41-C. Do not declare variables inside a switch statement before the first case label 43

Chapter 3: Expressions (EXP) 47 EXP30-C. Do not depend on the order of evaluation for side effects 48 EXP32-C. Do not access a volatile object through a nonvolatile reference 54 EXP33-C. Do not read uninitialized memory 56 EXP34-C. Do not dereference null pointers 65 EXP35-C. Do not modify objects with temporary lifetime 70 EXP36-C. Do not cast pointers into more strictly aligned pointer types 73 EXP37-C. Call functions with the correct number and type of arguments 77 EXP39-C. Do not access a variable through a pointer of an incompatible type 83 EXP40-C. Do not modify constant objects 89 EXP42-C. Do not compare padding data 91 EXP43-C. Avoid undefined behavior when using restrict-qualified pointers 93 EXP44-C. Do not rely on side effects in operands to sizeof, _Alignof, or _Generic 102 EXP45-C. Do not perform assignments in selection statements 105

Chapter 4: Integers (INT) 111 INT30-C. Ensure that unsigned integer operations do not wrap 112 INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data 118 INT32-C. Ensure that operations on signed integers do not result in overflow 126 INT33-C. Ensure that division and remainder operations do not result in divide-by-zero errors 135 INT34-C. Do not shift an expression by a negative number of bits or by greater than or equal to the number of bits that exist in the operand 138 INT35-C. Use correct integer precisions 143 INT36-C. Converting a pointer to integer or integer to pointer 145

Chapter 5: Floating Point (FLP) 151 FLP30-C. Do not use floating-point variables as loop counters 152 FLP32-C. Prevent or detect domain and range errors in math functions 154 FLP34-C. Ensure that floating-point conversions are within range of the new type 163 FLP36-C. Preserve precision when converting integral values to floating-point type 166

Chapter 6: Arrays (ARR) 169 ARR30-C. Do not form or use out-of-bounds pointers or array subscripts 170 ARR32-C. Ensure size arguments for variable length arrays are in a valid range 180 ARR36-C. Do not subtract or compare two pointers that do not refer to the same array 182 ARR37-C. Do not add or subtract an integer to a pointer to a non-array object 184 ARR38-C. Guarantee that library functions do not form invalid pointers 187 ARR39-C. Do not add or subtract a scaled integer to a pointer 196

Chapter 7: Characters and Strings (STR) 201 STR30-C. Do not attempt to modify string literals 202 STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator 205 STR32-C. Do not pass a non-null-terminated character sequence to a library function that expects a string 218 STR34-C. Cast characters to unsigned char before converting to larger integer sizes 223 STR37-C. Arguments to character handling functions must be representable as an unsigned char 227 STR38-C. Do not confuse narrow and wide character strings and functions 229

Chapter 8: Memory Management (MEM) 233 MEM30-C. Do not access freed memory 234 MEM31-C. Free dynamically allocated memory when no longer needed 239 MEM33-C. Allocate and copy structures containing a flexible array member dynamically 241 MEM34-C. Only free memory allocated dynamically 246 MEM35-C. Allocate sufficient memory for an object 250 MEM36-C. Do not modify the alignment of objects by calling realloc() 253

C…